thruk-mcp
Allows querying and managing hosts, services, downtimes, acknowledgements, and more in Icinga monitoring instances via Thruk's REST API.
Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@thruk-mcpshow me all critical services"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
thruk-mcp
Model Context Protocol (MCP) server for Thruk — the unified web frontend for Naemon, Nagios, Icinga and Shinken.
Expose Thruk's REST API to MCP-compatible clients (Claude Desktop, Dust, LibreChat, OpenWebUI...) so that an LLM can query hosts/services, schedule downtimes, acknowledge problems, force rechecks and more in natural language.
Features
Read: hosts, services, hostgroups, servicegroups, downtimes, comments, sites, aggregated stats, current problems
Write: schedule/delete downtimes, acknowledge & remove acks, force rechecks
Escape hatch:
thruk_querytool to call any Thruk REST endpointMulti-backend support (Thruk federated sites): pass
backends="prod,dr"to any toolTransports: stdio (default) or Streamable-HTTP (
--listen <port>, endpoint/mcp)Async httpx client with proper error handling and TLS verification
Tested with
pytest+respx, linted withruff, packaged withhatchling
Related MCP server: vibeMK
Quick start
1. Configure
cp .env.example .env
$EDITOR .env # set THRUK_BASE_URL and THRUK_API_KEYAn API key can be created from the Thruk user profile page (requires api_keys_enabled in thruk_local.conf) or via the REST API itself.
2a. Run with Docker
docker compose up -d
# MCP Streamable-HTTP endpoint: http://localhost:8001/mcp2b. Run locally
pip install thruk-mcp # or: pipx install thruk-mcp
# stdio mode (for Claude Desktop, LibreChat, etc.)
thruk-mcp
# Streamable-HTTP mode — endpoint http://localhost:8001/mcp
thruk-mcp --listen 8001
# equivalently: thruk-mcp --transport streamable-http --listen 8001
# Behind a load balancer / multiple replicas, drop per-session state
# (no sticky routing required):
thruk-mcp --listen 8001 --stateless --json-response
# Multi-tenant: each request brings its own Thruk credentials via headers
# (no fixed THRUK_API_KEY at boot). Requires --stateless; serve over TLS.
thruk-mcp --listen 8001 --stateless --header-authFor local development of the project itself, see CONTRIBUTING.md.
3. Wire it to an MCP client
Claude Desktop (~/.config/Claude/claude_desktop_config.json or macOS equivalent):
{
"mcpServers": {
"thruk": {
"command": "thruk-mcp",
"env": {
"THRUK_BASE_URL": "https://monitor.example.com/thruk",
"THRUK_API_KEY": "xxxxxxxx"
}
}
}
}4. Use with the Docker MCP Gateway
The image at ghcr.io/k9fr4n/thruk-mcp:latest defaults to stdio transport, so it can be spawned natively by the gateway.
Option A — Private local catalog
# 1. Create your private catalog
docker mcp catalog create thruk-private
# 2. Register this server (catalog/server.yaml ships with the repo)
docker mcp catalog add thruk-private thruk-mcp ./catalog/server.yaml
# 3. Configure credentials & enable
docker mcp secret set thruk-mcp.api_key=YOUR_KEY
docker mcp config write thruk-mcp.base_url=https://monitor.example.com/thruk
docker mcp server enable thruk-mcp
# 4. Run the gateway with your catalog
docker mcp gateway run --catalog thruk-privateThen point any MCP client (Claude Desktop, VS Code, Cursor, ...) at the gateway as documented here.
Option B — Submit upstream
catalog/server.yaml, catalog/tools.json and catalog/readme.md follow the docker/mcp-registry schema and can be submitted to the official Docker MCP Catalog via PR.
What's exposed
65 MCP Tools
Read — state
thruk_list_hosts, thruk_get_host, thruk_list_services, thruk_get_service,
thruk_list_hostgroups, thruk_list_servicegroups, thruk_list_contacts, thruk_get_contact,
thruk_problems, thruk_stats, thruk_totals (compact 16-field host+service totals, faster
than thruk_stats), thruk_sites.
Read — history & comments
thruk_list_logs, thruk_list_alerts, thruk_list_notifications,
thruk_notification_summary (notifications grouped by contact/host/service/state/command),
thruk_recent_events, thruk_list_comments, thruk_list_downtimes, thruk_get_downtime,
thruk_state_at (reconstruct the parc state at a past instant from /logs — a post-mortem
snapshot), thruk_state_diff (what changed between two past instants t1 → t2, replayed
from /logs).
Read — noise & flap analysis
thruk_top_noisy_hosts (hosts ranked by alert count over a window),
thruk_top_noisy_services (services ranked by alert count),
thruk_flap_summary (hosts/services ranked by state transition count).
Read — problem intelligence
thruk_oldest_problems (unhandled problems sorted by age, oldest first),
thruk_unacked_critical (CRITICAL/DOWN not acknowledged for > N minutes),
thruk_stale_acks (acknowledgements older than N days — forgotten problems),
thruk_problem_counts (flat aggregate of unhealthy-state counts, filterable by hostgroup,
custom vars or any structured filter — replaces the former thruk_problems_by_hostgroup),
thruk_stale_checks (surface checks that stopped running — the dangerous "false green"),
thruk_backend_health (per-site supervision-backend health: latency, replication lag,
blind spots), thruk_worker_health (distinguish a real outage from a mod-gearman
supervision blind spot).
Read — analytics
thruk_alert_heatmap (alert counts bucketed by time, useful for spotting recurring
patterns), thruk_notification_heatmap (notification counts bucketed by time — spot
mail/paging storms), thruk_concurrent_failures (windows where multiple hosts failed
simultaneously),
thruk_recurring_problems (hosts/services generating repeated alerts over a window),
thruk_root_cause (collapse a DOWN/UNREACHABLE storm into its root cause(s) via parent
topology), thruk_unreachable_vs_down (split a host outage window into DOWN cause vs
UNREACHABLE consequence).
Read — availability / SLA
thruk_host_availability (uptime % for a single host — time_up_percent, time_down_percent,
time_unreachable_percent and scheduled equivalents),
thruk_service_availability (ok/warning/critical/unknown % for a single service),
thruk_hostgroup_availability (availability for all hosts or services in a hostgroup,
sorted worst-first; type = hosts | services | both),
thruk_hostgroup_availability_summary (one aggregated rollup instead of one row per host —
time-weighted availability_percent, worst/best, below_threshold count, state
distribution; ideal for incident/SLA reports on large groups).
All accept since/until (Thruk relative or ISO) or a timeperiod shortcut
(lastmonth, thismonth, last24hours, lastweek, …).
thruk_reliability_report (per host/service reliability metrics — MTTR / MTBF /
incident counts — derived from the log over a window).
thruk_incident_timeline (ordered event chronology — the post-mortem "déroulé" — for a
host, service or hostgroup: every state change, notification, downtime, flap and
acknowledgement in time order, plus an incident/MTTR summary; a scoping filter is required).
Read — performance data
thruk_get_perfdata (fetch and parse performance data for a single host or service),
thruk_perfdata_snapshot (parsed perfdata for every service matching a filter, in one call),
thruk_perfdata_near_threshold (metrics within within_percent % of breaching their
warn/crit range — early-warning signal before an alert fires).
Write — downtime management
thruk_schedule_downtime (host/service), thruk_schedule_host_services_downtime
(all services of a host), thruk_schedule_propagated_host_downtime (parent+children),
thruk_schedule_hostgroup_downtime, thruk_schedule_servicegroup_downtime,
thruk_delete_downtime, thruk_delete_active_downtimes,
thruk_delete_downtimes_by_filter.
Write — problem handling
thruk_acknowledge, thruk_bulk_acknowledge (acknowledge multiple hosts/services in one call),
thruk_remove_acknowledgement, thruk_recheck,
thruk_add_comment, thruk_delete_comment,
thruk_checks (enable/disable active checks for a host or service),
thruk_notifications (enable/disable host or service notifications, with optional
cascade to all services of a host).
Escape hatches
thruk_query (raw call to any REST endpoint), thruk_run_background_query
(long-running endpoint via Thruk's ?background=1 mechanism with automatic
job polling).
All list-style tools share a consistent
limit/offset/sort/columnscontract. By default they return a tight subset of columns (~10 fields per row) to keep LLM token consumption low. Passcolumns=""to opt out and receive every column the Thruk row contains.
5 MCP Resources
URI templates that MCP clients with a resource browser (Claude Desktop, VS Code, ...) can "open" like files:
URI | Content |
| Full host JSON |
| Full service JSON |
| Host group config + members |
| Current unhandled problems (hosts + services) |
| Aggregated host/service stats (cached) |
3 MCP Prompts
Pre-canned workflows the user can invoke as a slash-command in the MCP client UI:
Prompt | Arguments | Purpose |
|
| 7-step incident triage |
|
| Safe downtime workflow with confirmation |
|
| Root-cause a flapping service (uses |
| optional | Morning read-only health digest (totals, unacked, stale, oldest, noisiest) |
| optional | Major-incident triage: blast radius, common cause, prioritised actions |
| optional | Saturation review of metrics nearing their warn/crit thresholds |
|
| Availability / SLA report with downtime breakdown and 99.9% verdict |
| optional | Alert-fatigue hygiene: noisiest, flapping, recurring, heatmap clustering |
Robustness
Connection retries —
httpx.AsyncHTTPTransport(retries=3)handles DNS failures, connection refusals, TLS handshakes.HTTP retries with backoff — 5xx and 429 responses are retried up to 3 times with exponential backoff + jitter (cap 5 s).
Opt-in TTL cache — slow-moving endpoints (
/sites,/processinfo,/hosts/stats,/services/stats,/contacts,/timeperiods, ...) are cached in-process for 15 s. Any tool can request caching viacache_ttl=on the underlying client. This absorbs the burst of identical calls an LLM agent typically issues across a multi-tool turn.Pagination helper —
ThrukClient.get_all()is an async generator that iterates pages of 500 rows up to a configurable hard limit (default 50 000), so internal callers can scan entire backends without manual offset math.Long-running queries — the
thruk_run_background_querytool wraps Thruk's?background=1flow and polls/thruk/jobs/<id>/outputuntil the job completes (5 min default timeout).
Environment variables
Connection
Variable | Default | Description |
|
| Thruk URL (no trailing slash) |
| (required) |
|
| Impersonation user (superuser key only) | |
|
| Set |
|
| HTTP timeout in seconds |
| CSV of default backend names (federated Thruk) |
Security / multi-tenant (v0.6)
Variable | Default | Description |
|
| Strip every write tool (ack, downtime, recheck, ...) |
| Allowlist of tool names. CSV with fnmatch wildcards. Empty = all | |
|
| Emit one JSON audit line on stderr per write tool invocation |
|
| Cap of concurrent in-flight HTTP requests. 0 = unlimited |
|
| Streamable-HTTP multi-tenant: take credentials from per-request headers (= |
| Bearer token gating the | |
|
| Opt out of the bearer requirement (proxy-fronted deploys). Leaves |
|
| CSV |
Security
Read-only mode — set
THRUK_READ_ONLY=trueto remove every write tool (thruk_acknowledge,thruk_schedule_*_downtime,thruk_recheck,thruk_delete_*,thruk_run_background_query) from the MCP server. The LLM literally cannot mutate monitoring state. Use this for general-purpose agents that should only observe.Tool allowlist —
THRUK_ENABLED_TOOLS=thruk_list_*,thruk_problems,thruk_statsrestricts the exposed surface to the listed tools (fnmatch wildcards supported). Useful when fronting multiple LLM clients with the same gateway but different scopes.Audit log — every write tool invocation emits one JSON line on
thruk_mcp.audit(stderr by default):{"ts":"2026-05-17T22:00:00+00:00","tool":"thruk_acknowledge","user":"alice", "args":{"host":"srv01","comment":"investigating"},"target":"srv01","status":"ok"}Disable with
THRUK_AUDIT_LOG=false. Sensitive keys (api_key,password,token) are redacted as***before logging.Rate limit —
THRUK_MAX_CONCURRENT=8caps in-flight HTTP requests with anasyncio.Semaphore. Combined with the v0.3 TTL cache, this protects the Thruk core from an LLM that loops on tools or chains them aggressively.Transport-level HTTP auth — gate the Streamable-HTTP
/mcpendpoint itself, independently of the Thruk credentials a request carries (no effect on stdio). SetMCP_HTTP_TOKEN=<secret>to require anAuthorization: Bearer <token>header (constant-time compare;401+WWW-Authenticate: Bearerotherwise). HTTP serving fails closed —--listen/--transport streamable-httprefuses to start unlessMCP_HTTP_TOKENis set orMCP_HTTP_ALLOW_UNAUTHENTICATED=trueis given (explicit opt-out for proxy-fronted deploys).MCP_HTTP_ALLOWED_HOSTSenforces aHostallowlist (anti-DNS-rebinding, defaults to loopback). The chain isTrustedHost → Bearer → HeaderAuth → /mcp, so the bearer gate composes with header-auth multi-tenant mode below.Header-auth multi-tenant — run
thruk-mcp --listen 8001 --stateless --header-auth(orTHRUK_HTTP_HEADER_AUTH=1) to serve many users from one process, each with their own Thruk credentials supplied per request via headers:Header
Maps to
Required
X-Thruk-Auth-Keyapi_keyyes (else
401)X-Thruk-Base-Urlbase_urlno (falls back to
THRUK_BASE_URL)X-Thruk-Auth-Userauth_userno
X-Thruk-Backendsdefault_backends(CSV)no
The server boots without
THRUK_API_KEY. Only credential/endpoint fields come from headers —THRUK_READ_ONLY,THRUK_ENABLED_TOOLSandTHRUK_AUDIT_LOGremain server-owned, so a tenant cannot grant itself write access or silence the audit log (which still attributes each call to the tenant'sauth_user). Per-tenant HTTP clients are pooled in a bounded LRU cache. The API key travels in a header, so serve only over TLS (terminate TLS in front, or behind a trusted reverse proxy). Requires--stateless.
Development
pip install -e ".[dev]"
pre-commit install # one-time setup of git hooks
ruff check src tests && ruff format src tests # lint + format
mypy src # type-check
pytest -v --cov=thruk_mcp --cov-fail-under=80 # tests with coverage gateConventions:
Conventional Commits (
feat:,fix:,chore:,docs:,refactor:,test:).No direct push to
main: branch → PR → squash merge.Any new tool must come with a
respx-mocked unit test intests/test_tools.py; regeneratecatalog/tools.json(Docker MCP Registry contract) withpython scripts/gen_tools_json.py— it is generated from the live registry, not hand-edited, and CI enforces it via--check.CI gate:
ruff,ruff format --check,mypy,pytestwith 80 % coverage minimum.
References
Thruk REST API: https://www.thruk.org/documentation/rest.html
Thruk REST commands: https://www.thruk.org/documentation/rest_commands.html
MCP spec: https://spec.modelcontextprotocol.io/
Inspired by: https://github.com/lausser/omd-mcp (initial proof-of-concept)
Project docs
CHANGELOG.md — what changed in each release.
UPGRADING.md — per-version migration notes.
SUPPORT.md — supported Python / Thruk / MCP-client versions, security policy, release cadence.
CONTRIBUTING.md — dev setup, PR conventions, tool / env-var contribution checklists.
License
MIT — see LICENSE.
Available Tools
65 toolsthruk_acknowledgeC
Acknowledge a host or service problem.
| Name | Required | Description | Default |
|---|---|---|---|
| host | Yes | Host name | |
| author | No | ||
| notify | No | ||
| sticky | No | ||
| comment | No | ||
| service | No | ||
| backends | No | Comma-separated backend names (sites). Omit for all backends. | |
| persistent | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of disclosing behavioral traits. It fails to mention whether the action is reversible, requires certain permissions, or affects notifications. The word 'acknowledge' implies a non-destructive operation but doesn't confirm or elaborate.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise (5 words), which is efficient but at the cost of missing critical details. It is front-loaded but lacks structure. While not verbose, it is too minimal for a complex tool with 8 parameters.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description is severely incomplete given the tool's complexity: 8 parameters, no output schema, no annotations, and low schema coverage. It provides almost no context about behavior, return values, or usage examples.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is only 25% (2 of 8 parameters have descriptions). The tool description adds no additional meaning to parameters beyond what is minimally present in the schema. For a tool with 8 parameters and low coverage, the description should compensate but does not.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action 'Acknowledge' and the resource 'host or service problem', making the purpose clear. However, it does not differentiate from sibling tools like thruk_bulk_acknowledge or thruk_remove_acknowledgement, so it doesn't achieve the highest score.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives, such as thruk_bulk_acknowledge for multiple items or thruk_remove_acknowledgement for reversal. The description lacks context on prerequisites or typical scenarios.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
thruk_add_commentC
Add a free-form operator comment on a host or service.
| Name | Required | Description | Default |
|---|---|---|---|
| host | Yes | Host name | |
| author | No | ||
| comment | Yes | Free-form comment text to attach to the host or service. | |
| service | No | ||
| backends | No | Comma-separated backend names (sites). Omit for all backends. | |
| persistent | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It only states it adds a comment, but does not disclose behavior like whether it overwrites or appends, the effect of the 'persistent' flag, or permission requirements.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence with no wasted words. However, it could be slightly expanded to include critical parameter context without losing conciseness.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no output schema, no annotations, and numerous sibling tools, the description lacks information on return values, error cases, or when to select this tool over similar ones like thruk_acknowledge.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 50% schema description coverage, the description does not compensate for undocumented parameters like 'author', 'service', 'backends', or 'persistent'. It adds no additional meaning beyond what is already in the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it adds a free-form operator comment on a host or service, which distinguishes it from sibling tools like thruk_list_comments and thruk_delete_comment. The verb and resource are specific.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives, such as prerequisites or scenarios. The context implies use for adding comments, but no explicit exclusion or comparison.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
thruk_alert_heatmapC
Return alert counts grouped by time bucket over a window.
| Name | Required | Description | Default |
|---|---|---|---|
| since | No | Start of analysis window. Thruk relative time ("-2h", "-7d") or ISO datetime ("2026-05-21 14:00:00"). Default: last 24 h. | -24h |
| until | No | End of the time window (same formats as since). Default: now. | |
| bucket | No | Time bucket width: '15m', '30m', '1h' (default), '6h', '1d'. | 1h |
| filter | No | Structured filter tree supporting AND/OR nesting. Two node types: leaf: {"type":"leaf", "field":"...", "op":"...", "value":...} group: {"type":"group", "operator":"and"|"or", "conditions":[...]} Available fields: custom_var, host, hostgroup, service Operators: eq, gte, in, lte, neq, regex Examples: # Objects in HG_AGILE: {"type":"leaf","field":"hostgroup","op":"eq","value":"HG_AGILE"} # In HG_AGILE OR with KERNEL=windows: {"type":"group","operator":"or","conditions":[ {"type":"leaf","field":"hostgroup","op":"eq","value":"HG_AGILE"}, {"type":"leaf","field":"custom_var","op":"eq","value":{"var":"KERNEL","val":"windows"}} ]} | |
| backends | No | Comma-separated backend names (sites). Omit for all backends. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, and the description is too brief to disclose behavioral traits such as idempotency, rate limits, or what happens with empty results. The description carries the full burden but only states the basic action.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single concise sentence that efficiently conveys the core functionality. It earns its place without unnecessary words, though it could benefit from slight expansion.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the lack of an output schema, the description should explain the return format (e.g., array of objects with time bucket and count). The current description is too vague, leaving the agent to guess the output structure.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so baseline is 3. The description adds minimal meaning beyond the schema (e.g., 'time bucket' and 'window' map to parameters), but the schema already provides detailed descriptions for all parameters, including the filter structure.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool returns alert counts grouped by time bucket over a window, using specific verbs and resources. However, it does not differentiate from sibling tools like thruk_list_alerts or thruk_notification_heatmap.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives such as thruk_list_alerts for raw alerts or thruk_notification_heatmap for notification counts. There is no mention of prerequisites or context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
thruk_backend_healthC
Per-site supervision-backend health: latency, replication lag, blind spots.
| Name | Required | Description | Default |
|---|---|---|---|
| backends | No | Comma-separated backend names (sites). Omit for all backends. | |
| lag_warn_seconds | No | Data-freshness age (seconds) above which a connected backend is flagged 'degraded' for stale cache / replication lag (default 120). | |
| latency_warn_seconds | No | Livestatus response time (seconds) above which a connected backend is flagged 'degraded' (default 5.0). |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description bears full burden for behavioral disclosure. It merely lists metrics but does not mention safety (read-only?), permissions, or performance implications. Missing critical context for an agent.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence, no wasted words. Appropriate length for a simple health check tool, though more detail could be added without becoming verbose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No output schema provided, so description should explain output format. It only hints at metrics without structure. With 3 optional parameters and no return value description, the description is incomplete for an agent to correctly use the tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so each parameter has its own description. The tool description does not add extra meaning beyond what the schema provides. Baseline score of 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states the tool returns per-site supervision-backend health metrics covering latency, replication lag, and blind spots. It distinguishes from sibling tools like thruk_worker_health and thruk_sites, though not explicitly.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool vs alternatives. Sibling tools cover various monitoring aspects, but the description does not help an agent decide to use this over others.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
thruk_bulk_acknowledgeB
Acknowledge every unhandled problem matching the given filters in one call.
| Name | Required | Description | Default |
|---|---|---|---|
| state | No | Restrict to a single state: 'down' / 'unreachable' (hosts) or 'critical' / 'warning' / 'unknown' (services). None (default) matches every non-OK problem. | |
| author | No | ||
| notify | No | ||
| sticky | No | ||
| comment | No | ||
| backends | No | Comma-separated backend names (sites). Omit for all backends. | |
| hostgroup | No | ||
| hosts_only | No | ||
| persistent | No | ||
| services_only | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description must disclose side effects, but it only states the basic action. It does not mention consequences of acknowledging (e.g., alert suppression), authorization needs, rate limits, or the scope of unhandled problems.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, front-loaded sentence that conveys the core purpose without unnecessary words. Every word earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the complexity of the tool (10 parameters, no output schema, no annotations), the description is too brief. It lacks details on return values, prerequisites, and behavioral context needed for safe invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is only 20%, and the tool description adds no parameter-level information. It does not help clarify the meaning or usage of the 10 parameters beyond what the sparse schema provides.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('Acknowledge'), the resource ('every unhandled problem'), and the method ('matching the given filters in one call'). It distinguishes from the sibling thruk_acknowledge by emphasizing bulk operation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage when you want to acknowledge multiple problems at once, but does not explicitly state when to use this tool versus thruk_acknowledge or other alternatives. No exclusions or prerequisites are provided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
thruk_checksC
Enable or disable active checks for a host or service.
| Name | Required | Description | Default |
|---|---|---|---|
| host | Yes | Host name | |
| cascade | No | When true and no service is specified, also apply to all services of the host. Ignored when service is set. | |
| enabled | Yes | True to enable active checks, False to disable. | |
| service | No | Service description. Omit to target the host only (use cascade=true to also cover all its services). | |
| backends | No | Comma-separated backend names (sites). Omit for all backends. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description bears full responsibility for disclosing behavioral traits. It states the action (enable/disable) but fails to mention side effects (e.g., immediate impact on monitoring, dependency on backend availability, or whether changes are persistent). Agents need more detail to assess risk.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence that efficiently states the core function, with no redundant words. However, it could be improved by front-loading key constraints (e.g., 'for a specific host or service') without adding bulk. It is concise but slightly under-informative for the number of parameters.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool modifies state, has 5 parameters, no output schema, and no annotations, the description is insufficient. It omits return values, error conditions, and practical examples. For a mutation tool with conditional logic (cascade, backends), the description should provide more complete context to guide correct invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so baseline is 3. The description adds no parameter-specific detail beyond the schema, just an overall statement. It doesn't explain how 'cascade' works or the role of 'backends' beyond what's in the schema, so no extra value is provided.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The verb 'Enable or disable' is specific and the resource 'active checks for a host or service' is clear. However, it does not differentiate from sibling tools like thruk_recheck or thruk_stale_checks, which also modify check behavior. Without distinction, the agent may not understand when to choose this over others.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives, no prerequisites, and no exclusions. For example, it doesn't mention that disabling checks is distinct from scheduling downtime or acknowledging problems. The agent is left to infer usage context on its own.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
thruk_concurrent_failuresB
Detect time windows where multiple hosts failed concurrently.
| Name | Required | Description | Default |
|---|---|---|---|
| since | No | Start of analysis window. Thruk relative time ("-2h", "-7d") or ISO datetime ("2026-05-20 14:00:00"). Default: last 1 hour. | -1h |
| until | No | End of the time window (same formats as since). Default: now. | |
| filter | No | Structured filter tree supporting AND/OR nesting. Two node types: leaf: {"type":"leaf", "field":"...", "op":"...", "value":...} group: {"type":"group", "operator":"and"|"or", "conditions":[...]} Available fields: custom_var, host, hostgroup Operators: eq, gte, in, lte, neq, regex Examples: # Objects in HG_AGILE: {"type":"leaf","field":"hostgroup","op":"eq","value":"HG_AGILE"} # In HG_AGILE OR with KERNEL=windows: {"type":"group","operator":"or","conditions":[ {"type":"leaf","field":"hostgroup","op":"eq","value":"HG_AGILE"}, {"type":"leaf","field":"custom_var","op":"eq","value":{"var":"KERNEL","val":"windows"}} ]} | |
| backends | No | Comma-separated backend names (sites). Omit for all backends. | |
| min_hosts | No | Minimum number of distinct hosts failing in a window to be reported. | |
| window_minutes | No | Sliding window width in minutes. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It does not disclose whether the tool is read-only, what it returns, or any side effects. For a detection tool, it likely performs a read-only analysis, but this is not stated.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence—concise but underspecified. It could include brief context about expected output or typical use cases without sacrificing conciseness.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description should provide hints about the return value (e.g., timestamp intervals, host lists, failure counts). This is missing. However, the input schema is well-documented, so completeness is acceptable but not outstanding.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, and the schema descriptions are thorough (e.g., explaining relative times, filter structure). The tool description adds no additional parameter meaning beyond what the schema already provides, so a baseline score of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: 'Detect time windows where multiple hosts failed concurrently.' It uses a specific verb ('Detect') and resource ('time windows where multiple hosts failed'), and this purpose distinguishes it from sibling tools like thruk_problems or thruk_alert_heatmap.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no explicit guidance on when to use this tool versus alternatives like thruk_root_cause or thruk_alert_heatmap. It does not state exclusions, prerequisites, or recommended contexts. Usage is only implied by the purpose.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
thruk_delete_active_downtimesA
Remove ALL currently active downtimes for a host (or one specific service).
| Name | Required | Description | Default |
|---|---|---|---|
| host | Yes | ||
| service | No | ||
| backends | No | Comma-separated backend names (sites). Omit for all backends. | |
| retry_on_empty | No | Retry the /downtimes lookup once after a short delay if the first query returns no matches. Works around Naemon's async command pipe (issue #194). Default: True. | |
| retry_delay_seconds | No | Seconds to wait before the retry when retry_on_empty=True. Set to 0 to disable the wait. Default: 2.0. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries full burden. It states it 'Remove' (destructive), but does not disclose permissions required, reversibility, or side effects like whether all downtimes are removed permanently without confirmation. Minimal behavioral detail beyond the action.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, concise sentence (12 words) that front-loads the action and scope. Every word adds value, and there is no extraneous information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a deletion tool, the description covers the core function and target. However, it lacks information about return values (e.g., success message, count of deleted downtimes) and does not specify if the operation is atomic. Nearly complete but missing return context.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 60%; the description adds context for 'host' and 'service' (targets a host or one service) but does not explain other parameters like retry_on_empty or retry_delay_seconds beyond what the schema provides. The description adds moderate value beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action 'Remove', scope 'ALL currently active downtimes', and target 'for a host (or one specific service)'. It effectively distinguishes from sibling tools like thruk_delete_downtime (single) and thruk_delete_downtimes_by_filter (filtered).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for bulk removal of all active downtimes for a host or service, but does not explicitly state when to use this tool versus alternatives such as thruk_delete_downtime or thruk_delete_downtimes_by_filter. No when-not or context is given.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
thruk_delete_commentB
Delete a host or service comment by its id.
| Name | Required | Description | Default |
|---|---|---|---|
| host | Yes | Host name owning the comment. | |
| service | No | ||
| backends | No | Comma-separated backend names (sites). Omit for all backends. | |
| comment_id | Yes | Numeric comment id (as returned by thruk_list_comments). |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries full burden. It states deletion but does not disclose error handling (e.g., missing comment), permission requirements, or side effects. Minimal transparency beyond the action itself.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single sentence that is directly informative with no unnecessary words or repetition. Efficiently conveys the core action.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a deletion tool with 4 parameters and no output schema, the description lacks essential context: expected behavior on success/failure, error types, required permissions, and relationship to other tools (e.g., list_comments for obtaining an id). The description is too minimal for a complete understanding.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 75% (host, backends, comment_id have descriptions). The description adds no extra meaning beyond the schema; the 'by its id' phrase is redundant with the comment_id parameter description. The 'service' parameter lacks a schema description and no additional clarity is provided.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action (delete) and the resource (host or service comment by its id). It is specific and distinguishes from sibling tools like thruk_add_comment or thruk_list_comments.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives, no prerequisites (e.g., comment must exist, id from list_comments), and no exclusion criteria. The agent is left to infer usage context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
thruk_delete_downtimeC
Delete a host or service downtime by its id.
| Name | Required | Description | Default |
|---|---|---|---|
| host | Yes | ||
| service | No | ||
| backends | No | Comma-separated backend names (sites). Omit for all backends. | |
| downtime_id | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided. The description states a destructive action but offers no behavioral details such as whether the operation is irreversible, permission requirements, or side effects. For a delete tool, this is insufficient.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single concise sentence. However, it may be too brief given the tool's complexity; a bit more detail would not hurt.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With four parameters, no output schema, and no annotations, the description is sparse. It does not explain the relationship between parameters or the expected behavior, leaving ambiguity about why host is required.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is only 25% (only backends has a description). The description mentions downtime_id but does not clarify the roles of host and service. It fails to explain why host is required despite the claim 'by its id'.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action (delete), the resource (downtime), and the criterion (by its id). It distinguishes itself from siblings like thruk_delete_active_downtimes and thruk_delete_downtimes_by_filter by specifying deletion by a single ID.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives like thruk_delete_active_downtimes or thruk_delete_downtimes_by_filter. The description gives no context about prerequisites or exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
thruk_delete_downtimes_by_filterB
Bulk-delete downtimes matching arbitrary filters.
| Name | Required | Description | Default |
|---|---|---|---|
| host | No | ||
| comment | No | ||
| service | No | ||
| backends | No | Comma-separated backend names (sites). Omit for all backends. | |
| hostgroup | No | ||
| start_time | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries full burden. It states 'delete' but does not explain the scope of deletion (all matching filters?), irreversibility, if confirmation is needed, or other side effects. The behavior is implied but not transparent.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single, clear sentence with no wasted words. It front-loads the core action and is appropriately sized for a minimal description.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a bulk delete operation with no output schema and 6 parameters, the description lacks essential context: how filters are combined, maximum deletions, rollback capability, or return behavior. It is incomplete for safe invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is only 17% (only 'backends' has a description). The tool description adds no parameter details about how filters combine (AND/OR), format of 'start_time', or meaning of NULL values. The description does not compensate for the poor schema coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description 'Bulk-delete downtimes matching arbitrary filters' uses a specific verb (bulk-delete) and resource (downtimes), clearly distinguishing it from sibling tools like thruk_delete_downtime (singular) and thruk_delete_active_downtimes.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives (e.g., thruk_delete_downtime for a single downtime), when not to use it, or any prerequisites. The description is too minimal to assist in tool selection.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
thruk_flap_summaryB
Return hosts and services with the most state transitions (flapping) over a time window.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | ||
| since | No | Start of analysis window. Thruk relative time ("-2h", "-7d") or ISO datetime ("2026-05-21 14:00:00"). Default: last 24 h. | -24h |
| until | No | End of the time window (same formats as since). Default: now. | |
| filter | No | Structured filter tree supporting AND/OR nesting. Two node types: leaf: {"type":"leaf", "field":"...", "op":"...", "value":...} group: {"type":"group", "operator":"and"|"or", "conditions":[...]} Available fields: custom_var, host, hostgroup, service Operators: eq, gte, in, lte, neq, regex Examples: # Objects in HG_AGILE: {"type":"leaf","field":"hostgroup","op":"eq","value":"HG_AGILE"} # In HG_AGILE OR with KERNEL=windows: {"type":"group","operator":"or","conditions":[ {"type":"leaf","field":"hostgroup","op":"eq","value":"HG_AGILE"}, {"type":"leaf","field":"custom_var","op":"eq","value":{"var":"KERNEL","val":"windows"}} ]} | |
| backends | No | Comma-separated backend names (sites). Omit for all backends. | |
| min_transitions | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description must fully disclose behavior, but it only states the high-level purpose. It does not mention that the operation is read-only, what 'most' means (e.g., sorted by transition count), or any side effects. Critical behavioral details are absent.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, clear sentence that is properly front-loaded. While it lacks detail, it achieves efficiency with zero wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Despite having 6 parameters, no output schema, and no annotations, the description is overly brief. It fails to explain key aspects like the role of limit, min_transitions, or how the time window works. The documentation is insufficient for comprehensive agent understanding.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 67% (4 of 6 parameters have descriptions). The tool description adds no additional parameter meaning beyond what the schema provides. Baseline is 3, and the description does not improve or degrade it.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: returning hosts and services with the most state transitions (flapping) over a time window. It uses a specific verb ('Return') and identifies the resource and concept, distinguishing it from other list tools like thruk_list_hosts.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives like thruk_list_alerts or thruk_problems. The description lacks context about appropriate scenarios or exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
thruk_get_contactB
Get a single Nagios/Naemon contact by name.
| Name | Required | Description | Default |
|---|---|---|---|
| contact | Yes | Contact name | |
| backends | No | Comma-separated backend names (sites). Omit for all backends. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description only states 'Get', implying a read operation, but does not disclose any behavioral traits such as idempotency, permissions required, or error conditions. Without annotations, more detail is expected.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single concise sentence that front-loads the purpose. While very brief, it is efficient for a simple retrieval tool. Could be improved with additional context without becoming verbose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has 2 parameters, no output schema, and no annotations, the description is incomplete. It lacks information on return values, error handling, and usage guidance, leaving gaps for the agent.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema provides descriptions for both parameters (contact name, backends). The description adds no extra meaning beyond 'by name', which aligns with the schema. Schema coverage is 100%, so baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action (Get), the resource (a single Nagios/Naemon contact), and the method (by name). It effectively distinguishes from the sibling tool 'thruk_list_contacts' which retrieves multiple contacts.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives, such as 'thruk_list_contacts' or other tools. The description lacks context or conditions for appropriate usage.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
thruk_get_downtimeB
Get a single downtime by id.
| Name | Required | Description | Default |
|---|---|---|---|
| backends | No | Comma-separated backend names (sites). Omit for all backends. | |
| downtime_id | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description must disclose behavioral traits. It only states 'get a single downtime by id' but does not confirm it's a read-only operation, describe error handling (e.g., if ID doesn't exist), or mention any side effects or limitations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, concise sentence that front-loads the core purpose. No extraneous words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple retrieval tool with no output schema, the description should explain the return value, possible errors, and any relevant context. It does not, leaving the agent with insufficient information to confidently invoke the tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 50% (only backends described). The description adds no parameter information, failing to compensate for the undocumented downtime_id parameter. It doesn't explain what a downtime_id is or its format.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description 'Get a single downtime by id' clearly states the action (get), the resource (downtime), and the identifier (id). It distinguishes from sibling tools like thruk_list_downtimes (list multiple) and thruk_delete_downtime (delete).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives like thruk_list_downtimes or thruk_schedule_downtime. There is no mention of prerequisites or context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
thruk_get_hostB
Get a single host by name.
| Name | Required | Description | Default |
|---|---|---|---|
| host | Yes | Host name | |
| backends | No | Comma-separated backend names (sites). Omit for all backends. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Without annotations, the description only implies read-only behavior but does not disclose authentication needs, error handling, or return details. It is minimal.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single short sentence that is front-loaded and contains no unnecessary words. Perfectly concise.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Adequate for a simple getter with two parameters, but lacks information about return format or error scenarios, which could be added given no output schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the description adds minimal value beyond parameter names and descriptions. The tool's purpose clarifies the host parameter but not backends.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it retrieves a single host by name, distinguishing it from listing tools like thruk_list_hosts and other getters.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives like thruk_list_hosts or thruk_get_service. The description is implicit but lacks explicit usage context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
thruk_get_perfdataB
Fetch and parse performance data for a single host or service.
| Name | Required | Description | Default |
|---|---|---|---|
| host | Yes | Host name | |
| service | No | Service description. Omit for the host check's own perfdata. | |
| backends | No | Comma-separated backend names (sites). Omit for all backends. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must fully convey behavioral traits. It only states 'Fetch and parse performance data', which implies a read operation but gives no details on side effects, authentication, rate limits, or what exactly 'parse' entails. This is insufficient for safe and effective use.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, well-structured sentence that front-loads the core purpose. Every word is necessary; there is no fluff or redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (3 parameters, no output schema), the description is too brief. It does not explain what 'perfdata' is, the format of the parsed output, any limitations (e.g., single host/service), or how to handle missing data. Agents would lack critical context for proper use.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema has 100% coverage with clear descriptions for all three parameters. The tool description adds minimal value beyond the schema, only clarifying the scope ('single host or service'). Baseline 3 is appropriate as the schema does the heavy lifting.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description 'Fetch and parse performance data for a single host or service' clearly states the action (fetch and parse), the resource (performance data), and the scope (single host or service). This distinguishes it from sibling tools like thruk_perfdata_near_threshold or thruk_perfdata_snapshot, which focus on different aspects of performance data.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no explicit guidance on when to use this tool versus alternatives. It does not mention prerequisites, when not to use it, or how it compares to other performance data tools. The context is only implied by the name.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
thruk_get_serviceA
Get a single service by host and description.
| Name | Required | Description | Default |
|---|---|---|---|
| host | Yes | Host name | |
| service | Yes | Service description | |
| backends | No | Comma-separated backend names (sites). Omit for all backends. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, so the description bears full burden. It fails to disclose side effects (none expected), permission requirements, or behavior on missing services, providing only minimal transparency.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, concise sentence with no redundancy, efficiently conveying the core purpose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
While the description clarifies the operation, it lacks details about the return format or contents. Without an output schema, the agent may need more context to interpret the result.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so parameters are fully defined in the schema. The description adds no extra meaning beyond the schema, earning the baseline score of 3.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses the specific verb 'Get' and identifies the resource as 'a single service', uniquely distinguished from sibling tools like 'thruk_list_services' (list) and 'thruk_get_host' (different resource).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for retrieving a single service by host and description, but does not explicitly contrast with alternatives (e.g., 'thruk_list_services' for multiple) or provide when-not-to-use guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
thruk_host_availabilityA
Compute availability (uptime / SLA %) for a host over a configurable time window.
| Name | Required | Description | Default |
|---|---|---|---|
| host | Yes | Host name | |
| since | No | Start of analysis window. Thruk relative time ("-7d", "-1m") or ISO datetime ("2026-05-01 00:00:00"). Default: last 7 days. Ignored when ``timeperiod`` is set. | -7d |
| until | No | End of analysis window (same formats as ``since``). Defaults to now. Ignored when ``timeperiod`` is set. | |
| backends | No | Comma-separated backend names (sites). Omit for all backends. | |
| timeperiod | No | Thruk-native time period shortcut: "last24hours", "lastweek", "lastmonth", "thismonth", etc. Overrides ``since``/``until`` when provided. | |
| with_downtimes | No | Count scheduled downtime periods as outages (withdowntimes=1). | |
| include_soft_states | No | Include soft state changes in calculations (includesoftstates=1). |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must convey behavioral traits. It correctly implies a read-only computation with no side effects, but does not explicitly state this or disclose any other behaviors (e.g., data sources, performance impact, output structure).
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, well-constructed sentence that front-loads the core verbs and key options. Every word carries meaning, with no wasted text.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With 7 parameters, medium complexity, and no output schema, the description covers the main purpose but lacks details about return values (e.g., percentage, time series) and does not explain the full context needed for effective use.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all parameters thoroughly. The description adds only the high-level notion of a 'configurable time window', providing marginal extra meaning beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool computes host availability (uptime/SLA%) over a configurable time window. It uses a specific verb-resource pair ('Compute availability' for a 'host') and distinguishes from siblings like thruk_service_availability and thruk_hostgroup_availability.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for host availability queries but does not explicitly guide when to use this tool versus alternatives (e.g., thruk_service_availability for services, thruk_hostgroup_availability for groups). No when-not-to-use or prerequisites are mentioned.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
thruk_hostgroup_availabilityC
Compute availability (uptime / SLA %) for all hosts/services in a hostgroup.
| Name | Required | Description | Default |
|---|---|---|---|
| type | No | What to return: 'hosts' (default), 'services', or 'both'. Hosts return time_up_percent; services return time_ok_percent. | hosts |
| since | No | Start of analysis window. Thruk relative time ("-7d", "-1m") or ISO datetime ("2026-05-01 00:00:00"). Default: last 7 days. Ignored when ``timeperiod`` is set. | -7d |
| until | No | End of analysis window (same formats as ``since``). Defaults to now. Ignored when ``timeperiod`` is set. | |
| backends | No | Comma-separated backend names (sites). Omit for all backends. | |
| hostgroup | Yes | Hostgroup name | |
| timeperiod | No | Thruk-native time period shortcut: "last24hours", "lastweek", "lastmonth", "thismonth", etc. Overrides ``since``/``until`` when provided. | |
| with_downtimes | No | Count scheduled downtime periods as outages (withdowntimes=1). | |
| include_soft_states | No | Include soft state changes in calculations (includesoftstates=1). |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, so description must bear full burden. It states only the purpose, with no disclosure of side effects, read-only nature, permissions, performance impact, or data volume considerations. Completely inadequate for behavioral transparency.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence, no waste, front-loaded with key information. However, could benefit from slightly more structure (e.g., separate lines) to improve readability.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With 8 parameters and no output schema, the description is too sparse. It doesn't explain return format or differentiate between 'hosts' vs 'services' output. Many sibling tools exist, but no contextual hints are provided.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema itself provides clear parameter definitions. The description adds no additional meaning beyond the schema, which is acceptable but not helpful. Baseline score of 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states verb 'compute', resource 'availability', and scope 'for all hosts/services in a hostgroup'. Distinguishes from sibling tools like thruk_host_availability (single host) and thruk_hostgroup_availability_summary (aggregate).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No explicit guidance on when to use this tool versus alternatives like thruk_host_availability, thruk_service_availability, or thruk_hostgroup_availability_summary. Missing context about when to choose this tool over siblings.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
thruk_hostgroup_availability_summaryA
Aggregated SLA rollup for a hostgroup — one summary line, not 380 rows.
| Name | Required | Description | Default |
|---|---|---|---|
| type | No | What to roll up: 'hosts' (default, time_up) or 'services' (time_ok). | hosts |
| since | No | Start of analysis window. Thruk relative time ("-7d", "-1m") or ISO datetime ("2026-05-01 00:00:00"). Default: last 7 days. Ignored when ``timeperiod`` is set. | -7d |
| until | No | End of analysis window (same formats as ``since``). Defaults to now. Ignored when ``timeperiod`` is set. | |
| backends | No | Comma-separated backend names (sites). Omit for all backends. | |
| hostgroup | Yes | Hostgroup name | |
| threshold | No | SLA threshold in percent; objects below it are counted in ``below_threshold`` (default 99.0). | |
| timeperiod | No | Thruk-native time period shortcut: "last24hours", "lastweek", "lastmonth", "thismonth", etc. Overrides ``since``/``until`` when provided. | |
| with_downtimes | No | Count scheduled downtime periods as outages (withdowntimes=1). | |
| include_soft_states | No | Include soft state changes in calculations (includesoftstates=1). |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided. The description does not explicitly state read-only or destructive behavior. It mentions 'one summary line' but lacks detail on permissions or side effects. Given the name suggests availability, it's adequate but not thorough.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise, one short sentence that is front-loaded and every word adds value. No fluff.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Tool has 9 parameters and no output schema. The description briefly explains the output nature but lacks details on return values or how to interpret the summary. It's acceptable but not fully complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so baseline is 3. The description adds minimal value beyond the schema; it only clarifies that output is a single summary line but does not explain parameter semantics further.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states 'Aggregated SLA rollup for a hostgroup — one summary line, not 380 rows,' which specifies the verb (rollup), resource (hostgroup), and distinguishes from sibling thruk_hostgroup_availability that likely returns detailed rows.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies when to use this tool (when a summary is needed) by contrasting with the sibling that returns many rows. However, it doesn't explicitly state when not to use or list alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
thruk_incident_timelineB
Ordered event chronology for a host / service / hostgroup (post-mortem "déroulé").
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Maximum number of timeline events to return, earliest first (default 500). The summary always covers the full window. | |
| since | No | Start of analysis window. Thruk relative time ("-2h", "-7d") or ISO datetime ("2026-05-21 14:00:00"). Default: last 24 h. | -24h |
| until | No | End of the time window (same formats as since). Default: now. | |
| filter | No | Structured filter tree supporting AND/OR nesting. Two node types: leaf: {"type":"leaf", "field":"...", "op":"...", "value":...} group: {"type":"group", "operator":"and"|"or", "conditions":[...]} Available fields: custom_var, host, hostgroup, service Operators: eq, gte, in, lte, neq, regex Examples: # Objects in HG_AGILE: {"type":"leaf","field":"hostgroup","op":"eq","value":"HG_AGILE"} # In HG_AGILE OR with KERNEL=windows: {"type":"group","operator":"or","conditions":[ {"type":"leaf","field":"hostgroup","op":"eq","value":"HG_AGILE"}, {"type":"leaf","field":"custom_var","op":"eq","value":{"var":"KERNEL","val":"windows"}} ]} | |
| backends | No | Comma-separated backend names (sites). Omit for all backends. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries full burden. It only mentions it returns an 'ordered event chronology' but does not disclose behavioral traits such as read-only nature, potential side effects, or permission requirements. It is vague about what events are included.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is very concise—two sentences, front-loaded with the core purpose. Every word adds value, including the French term for context.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no output schema and no annotations, the description should explain what the timeline contains (event types, fields) and how the return value is structured. It does not, leaving the agent with insufficient information to interpret the output.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, and the existing schema descriptions are good. The description does not add significant meaning beyond the schema. It introduces the term 'analysis window' for since/until but otherwise adds no new parameter semantics.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states that the tool provides an ordered event chronology for a host, service, or hostgroup, with a specific use case (post-mortem analysis). This distinguishes it from sibling tools like thruk_list_alerts or thruk_recent_events.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives. For example, it does not explain when to prefer this over thruk_list_alerts or thruk_state_diff. The description only states what it does, without contextual usage hints.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
thruk_list_alertsC
List HOST/SERVICE ALERT entries from the log.
| Name | Required | Description | Default |
|---|---|---|---|
| sort | No | Sort order: a column name, optionally prefixed with '-' for descending (e.g. 'name', '-last_check'); comma-separate multiple keys. Defaults to '-time'. | -time |
| limit | No | ||
| since | No | Start of the time window. Thruk relative time ("-2h", "-7d") or ISO datetime ("2026-05-21 14:00:00"). Omitted = no lower bound. | |
| until | No | End of the time window (same formats as since). Default: now. | |
| filter | No | Structured filter tree supporting AND/OR nesting. Two node types: leaf: {"type":"leaf", "field":"...", "op":"...", "value":...} group: {"type":"group", "operator":"and"|"or", "conditions":[...]} Available fields: custom_var, host, hostgroup, service, since, state, until Operators: eq, gte, in, lte, neq, regex The 'since'/'until' fields accept Thruk relative time ("-2h", "-7d") or ISO datetime ("2026-05-21 14:00:00"). Examples: # Hosts DOWN in HG_AGILE: {"type":"group","operator":"and","conditions":[ {"type":"leaf","field":"hostgroup","op":"eq","value":"HG_AGILE"}, {"type":"leaf","field":"state","op":"eq","value":"down"} ]} # Hosts in HG_AGILE OR with KERNEL=windows: {"type":"group","operator":"or","conditions":[ {"type":"leaf","field":"hostgroup","op":"eq","value":"HG_AGILE"}, {"type":"leaf","field":"custom_var","op":"eq","value":{"var":"KERNEL","val":"windows"}} ]} | |
| offset | No | ||
| columns | No | Comma-separated columns to return. Omit for a curated default set tuned for this tool; pass '' (empty string) to return all available columns. | |
| backends | No | Comma-separated backend names (sites). Omit for all backends. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, and the description does not disclose any behavioral traits (e.g., side effects, authentication needs, rate limits). It only states the basic function, leaving the agent without insight into tool behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence with no extraneous text. Efficient but could be slightly more informative without losing conciseness.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With 8 parameters, no output schema, and no annotations, the description is minimally informative. It does not explain return format, pagination, or filtering capabilities beyond what the schema provides. The tool is complex (filtering tree), yet the description omits this context.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 75%, so baseline is 3. The description itself adds no additional parameter context beyond the schema. It does not compensate for the remaining 25% of undocumented parameters.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description explicitly states it lists HOST/SERVICE ALERT entries from the log, which is a specific verb and resource. Among sibling tools like thruk_list_hosts or thruk_list_logs, it clearly distinguishes itself by focusing on alerts.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives such as thruk_list_logs or thruk_recent_events. No exclusions or context for optimal use.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
thruk_list_commentsB
List comments (acknowledgements appear here too).
| Name | Required | Description | Default |
|---|---|---|---|
| sort | No | Sort order: a column name, optionally prefixed with '-' for descending (e.g. 'name', '-last_check'); comma-separate multiple keys. Defaults to '-entry_time'. | -entry_time |
| limit | No | ||
| filter | No | Structured filter tree supporting AND/OR nesting. Two node types: leaf: {"type":"leaf", "field":"...", "op":"...", "value":...} group: {"type":"group", "operator":"and"|"or", "conditions":[...]} Available fields: custom_var, host, hostgroup Operators: eq, gte, in, lte, neq, regex Examples: # Objects in HG_AGILE: {"type":"leaf","field":"hostgroup","op":"eq","value":"HG_AGILE"} # In HG_AGILE OR with KERNEL=windows: {"type":"group","operator":"or","conditions":[ {"type":"leaf","field":"hostgroup","op":"eq","value":"HG_AGILE"}, {"type":"leaf","field":"custom_var","op":"eq","value":{"var":"KERNEL","val":"windows"}} ]} | |
| offset | No | ||
| columns | No | Comma-separated columns to return. Omit for a curated default set tuned for this tool; pass '' (empty string) to return all available columns. | |
| backends | No | Comma-separated backend names (sites). Omit for all backends. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description must disclose behavior. It only notes that acknowledgements appear, but omits that the operation is read-only, how filtering/pagination affects output, or any side effects.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Description is a single concise sentence with no waste. However, it could include more useful information without becoming verbose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given 6 parameters, no output schema, and no annotations, the description is too short. It lacks information about return format, offset/limit pagination behavior, and the nature of comment objects.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 67% (4 of 6 parameters have descriptions). The description adds no extra parameter information beyond what the schema already provides, so baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool lists comments and explicitly mentions that acknowledgements are included. It distinguishes from sibling tools like add/delete comment.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus similar list tools (e.g., list_downtimes, list_alerts). Missing context about prerequisites or typical use cases.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
thruk_list_contactsB
List configured Nagios/Naemon contacts (notification targets).
| Name | Required | Description | Default |
|---|---|---|---|
| sort | No | Sort order: a column name, optionally prefixed with '-' for descending (e.g. 'name', '-last_check'); comma-separate multiple keys. Defaults to 'name'. | name |
| limit | No | ||
| offset | No | ||
| columns | No | Comma-separated columns to return. Omit for a curated default set tuned for this tool; pass '' (empty string) to return all available columns. | |
| backends | No | Comma-separated backend names (sites). Omit for all backends. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries full burden but only states the basic function. It fails to disclose pagination (limit/offset from schema), read-only nature, or any authentication requirements, leaving significant behavioral gaps.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise (one sentence) but at the cost of missing critical context. It front-loads the purpose but is too brief to be fully helpful.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given 5 parameters, no output schema, and no annotations, the description is insufficient. It does not explain the output structure, how to use parameters, or any behavioral traits, leaving agents underinformed.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description adds no information about the parameters beyond what the input schema provides. With 60% schema coverage, the description should compensate but does not, leaving agents unaware of how to use 'sort', 'limit', 'offset', 'columns', or 'backends' effectively.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'list' and the resource 'configured Nagios/Naemon contacts (notification targets)', distinguishing it from the sibling 'thruk_get_contact' which gets a single contact.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for listing contacts but provides no explicit guidance on when to use this tool versus alternatives like 'thruk_get_contact' or other list tools, nor any exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
thruk_list_downtimesC
List scheduled downtimes.
| Name | Required | Description | Default |
|---|---|---|---|
| sort | No | Sort order: a column name, optionally prefixed with '-' for descending (e.g. 'name', '-last_check'); comma-separate multiple keys. Defaults to '-start_time'. | -start_time |
| limit | No | ||
| filter | No | Structured filter tree supporting AND/OR nesting. Two node types: leaf: {"type":"leaf", "field":"...", "op":"...", "value":...} group: {"type":"group", "operator":"and"|"or", "conditions":[...]} Available fields: custom_var, host, hostgroup Operators: eq, gte, in, lte, neq, regex Examples: # Objects in HG_AGILE: {"type":"leaf","field":"hostgroup","op":"eq","value":"HG_AGILE"} # In HG_AGILE OR with KERNEL=windows: {"type":"group","operator":"or","conditions":[ {"type":"leaf","field":"hostgroup","op":"eq","value":"HG_AGILE"}, {"type":"leaf","field":"custom_var","op":"eq","value":{"var":"KERNEL","val":"windows"}} ]} | |
| offset | No | ||
| columns | No | Comma-separated columns to return. Omit for a curated default set tuned for this tool; pass '' (empty string) to return all available columns. | |
| backends | No | Comma-separated backend names (sites). Omit for all backends. | |
| active_only | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden of behavioral disclosure. It fails to mention key traits such as the default 'active_only' filter (true), pagination via limit/offset, or the return format. The description is too minimal to inform the agent about side effects or permissions.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise at three words, but this is under-specification rather than efficient writing. It lacks necessary context and fails to earn its place by conveying meaningful information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has 7 parameters, no output schema, and no annotations, the description is severely incomplete. It does not explain default values, filtering options, or the nature of the data returned. The agent would have insufficient context to use the tool effectively.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 57%, so the description should add meaning beyond the schema. It does not mention any parameter details or provide context for the 7 parameters, offering no additional value over the schema's own descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description 'List scheduled downtimes' clearly states the verb and resource, making the basic function understandable. However, it does not differentiate from similar sibling tools like thruk_list_alerts or thruk_list_comments, which list other object types.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives. There are many list tools, and the description does not specify the context, filtering, or default behavior that would help an agent decide which tool to invoke.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
thruk_list_hostgroupsC
List host groups. Default columns return name/alias and host/service counts only.
| Name | Required | Description | Default |
|---|---|---|---|
| sort | No | Sort order: a column name, optionally prefixed with '-' for descending (e.g. 'name', '-last_check'); comma-separate multiple keys. Defaults to 'name'. | name |
| limit | No | ||
| offset | No | ||
| columns | No | Comma-separated columns to return. Omit for a curated default set tuned for this tool; pass '' (empty string) to return all available columns. | |
| backends | No | Comma-separated backend names (sites). Omit for all backends. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description provides minimal behavioral context: default columns returned. With no annotations provided, the description carries the full burden but omits side effects (none expected, but not stated), permissions, or output format details beyond default columns.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence with no unnecessary words. It is efficient, though it could include a bit more context without becoming verbose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with 5 parameters and no output schema, the description is incomplete. It lacks explanation of pagination (limit/offset), sorting, backends, and column selection customization. The minimal info leaves agents guessing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description adds information about default columns, which relates to output but not directly to parameters. Schema coverage is 60%, meaning some parameters lack descriptions, and the description does not compensate for those gaps.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('List host groups') and provides a specific detail about default columns, making the tool's purpose clear. However, it doesn't define what a host group is, but that is likely understood from context and the tool name.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is given on when to use this tool versus alternatives like 'thruk_list_hosts' or 'thruk_list_servicegroups'. There is no mention of prerequisites or exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
thruk_list_hostsC
List monitored hosts.
| Name | Required | Description | Default |
|---|---|---|---|
| sort | No | Sort order: a column name, optionally prefixed with '-' for descending (e.g. 'name', '-last_check'); comma-separate multiple keys. Defaults to 'name'. | name |
| limit | No | ||
| filter | No | Structured filter tree supporting AND/OR nesting. Two node types: leaf: {"type":"leaf", "field":"...", "op":"...", "value":...} group: {"type":"group", "operator":"and"|"or", "conditions":[...]} Available fields: address, custom_var, hostgroup, name, state Operators: eq, gte, in, lte, neq, regex Examples: # Hosts DOWN in HG_AGILE: {"type":"group","operator":"and","conditions":[ {"type":"leaf","field":"hostgroup","op":"eq","value":"HG_AGILE"}, {"type":"leaf","field":"state","op":"eq","value":"down"} ]} # Hosts in HG_AGILE OR with KERNEL=windows: {"type":"group","operator":"or","conditions":[ {"type":"leaf","field":"hostgroup","op":"eq","value":"HG_AGILE"}, {"type":"leaf","field":"custom_var","op":"eq","value":{"var":"KERNEL","val":"windows"}} ]} | |
| offset | No | ||
| columns | No | Comma-separated columns to return. Omit for a curated default set tuned for this tool; pass '' (empty string) to return all available columns. | |
| backends | No | Comma-separated backend names (sites). Omit for all backends. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must carry the full burden of behavioral disclosure. The description only states 'List monitored hosts' without mentioning pagination, filtering capabilities, or the fact that results are returned in JSON. The schema implies complex filtering and pagination, but the description adds no transparency beyond the bare minimum.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is overly terse (one sentence) for a tool with 6 parameters and complex filtering. It lacks structure and front-loads no key information. While concise, it is under-specified and fails to earn its brevity by omitting critical context.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (6 parameters, nested filter objects, no output schema), the description is incomplete. It fails to mention pagination, sorting, field selection, backend targeting, or the rich filtering capabilities that are documented in the schema. The agent is left without a high-level summary of the tool's capabilities.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 67% (4 of 6 parameters have descriptions), which is high. The description adds no additional parameter information beyond what the schema already provides. Baseline is 3, and the description does not improve or hinder parameter understanding.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description 'List monitored hosts' clearly states the verb (list) and resource (monitored hosts), distinguishing it from sibling tools like thruk_list_services or thruk_acknowledge. However, it does not differentiate from similar list tools like thruk_list_hostgroups or thruk_list_services, which could be confused without additional context.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives. Sibling tools include many list operations (e.g., thruk_list_services, thruk_list_alerts) but the description offers no context or exclusion criteria, leaving the agent to infer usage from the name alone.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
thruk_list_logsB
Query raw Livestatus log entries (/logs).
| Name | Required | Description | Default |
|---|---|---|---|
| sort | No | Sort order: a column name, optionally prefixed with '-' for descending (e.g. 'name', '-last_check'); comma-separate multiple keys. Defaults to '-time'. | -time |
| limit | No | ||
| since | No | Start of the time window. Thruk relative time ("-2h", "-7d") or ISO datetime ("2026-05-21 14:00:00"). Omitted = no lower bound. | |
| until | No | End of the time window (same formats as since). Default: now. | |
| filter | No | Structured filter tree supporting AND/OR nesting. Two node types: leaf: {"type":"leaf", "field":"...", "op":"...", "value":...} group: {"type":"group", "operator":"and"|"or", "conditions":[...]} Available fields: custom_var, host, hostgroup, message, service, since, until Operators: eq, gte, in, lte, neq, regex The 'since'/'until' fields accept Thruk relative time ("-2h", "-7d") or ISO datetime ("2026-05-21 14:00:00"). Examples: # Log entries matching a pattern since -2h: {"type":"group","operator":"and","conditions":[ {"type":"leaf","field":"message","op":"regex","value":"DISK.*CRITICAL"}, {"type":"leaf","field":"since","op":"gte","value":"-2h"} ]} | |
| offset | No | ||
| columns | No | Comma-separated columns to return. Omit for a curated default set tuned for this tool; pass '' (empty string) to return all available columns. | |
| backends | No | Comma-separated backend names (sites). Omit for all backends. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are present, so the description must carry the full burden of behavioral disclosure. It only states the basic purpose, omitting details such as read-only nature, performance implications, or whether it supports time windows beyond the schema defaults.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, front-loaded sentence that efficiently states the tool's purpose. Every word earns its place, and there is no unnecessary verbosity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the complexity (8 parameters, no output schema, many siblings), the description is too sparse. It lacks an overview of what logs are returned, how filtering works, and how it relates to similar tools like thruk_list_alerts.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 75%, so the schema already documents most parameters well. The description adds no meaning beyond what the schema provides, making it adequate but not improved.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: 'Query raw Livestatus log entries (/logs).' It uses a specific verb and resource, and implicitly distinguishes from sibling tools like thruk_list_alerts by targeting raw logs.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus its many siblings (e.g., thruk_list_alerts, thruk_list_notifications). The description lacks context about appropriate use cases or alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
thruk_list_notificationsC
List notification entries from the log (class=3).
| Name | Required | Description | Default |
|---|---|---|---|
| sort | No | Sort order: a column name, optionally prefixed with '-' for descending (e.g. 'name', '-last_check'); comma-separate multiple keys. Defaults to '-time'. | -time |
| limit | No | ||
| since | No | Start of the time window. Thruk relative time ("-2h", "-7d") or ISO datetime ("2026-05-21 14:00:00"). Omitted = no lower bound. | |
| until | No | End of the time window (same formats as since). Default: now. | |
| filter | No | Structured filter tree supporting AND/OR nesting. Two node types: leaf: {"type":"leaf", "field":"...", "op":"...", "value":...} group: {"type":"group", "operator":"and"|"or", "conditions":[...]} Available fields: contact, custom_var, host, hostgroup, service, since, state, until Operators: eq, gte, in, lte, neq, regex The 'since'/'until' fields accept Thruk relative time ("-2h", "-7d") or ISO datetime ("2026-05-21 14:00:00"). Examples: # Hosts DOWN in HG_AGILE: {"type":"group","operator":"and","conditions":[ {"type":"leaf","field":"hostgroup","op":"eq","value":"HG_AGILE"}, {"type":"leaf","field":"state","op":"eq","value":"down"} ]} # Hosts in HG_AGILE OR with KERNEL=windows: {"type":"group","operator":"or","conditions":[ {"type":"leaf","field":"hostgroup","op":"eq","value":"HG_AGILE"}, {"type":"leaf","field":"custom_var","op":"eq","value":{"var":"KERNEL","val":"windows"}} ]} | |
| offset | No | ||
| columns | No | Comma-separated columns to return. Omit for a curated default set tuned for this tool; pass '' (empty string) to return all available columns. | |
| backends | No | Comma-separated backend names (sites). Omit for all backends. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations supplied, the description must convey behavioral traits. It only mentions 'from the log (class=3)' without stating read-only nature, side effects, or any restrictions. The minimal description fails to provide needed transparency.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is very short (one sentence) and to the point, but it lacks important context that could be added without becoming verbose. Acceptable for conciseness, but could be more informative.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given 8 parameters and no output schema, the description is too sparse. It does not explain the filtering capability, time windows, or return format, leaving the agent with minimal guidance.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 75%, so baseline is 3. The description adds no information about parameters beyond what the schema already provides. It neither enhances nor detracts from schema's parameter documentation.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool lists notification entries from a specific log class (class=3), indicating the verb and resource. However, it does not differentiate from similar sibling tools like thruk_notifications or thruk_list_alerts, which could be ambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives such as thruk_notifications or thruk_list_alerts. The description lacks context about the log class or typical use cases.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
thruk_list_servicegroupsB
List service groups. Default columns return name/alias and counts only.
| Name | Required | Description | Default |
|---|---|---|---|
| sort | No | Sort order: a column name, optionally prefixed with '-' for descending (e.g. 'name', '-last_check'); comma-separate multiple keys. Defaults to 'name'. | name |
| limit | No | ||
| offset | No | ||
| columns | No | Comma-separated columns to return. Omit for a curated default set tuned for this tool; pass '' (empty string) to return all available columns. | |
| backends | No | Comma-separated backend names (sites). Omit for all backends. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the transparency burden. It mentions default column behavior but lacks details on side effects (none expected for a list tool), permissions, or response format. Adequate but minimal.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two succinct sentences: first states the action, second adds key detail about default output. No fluff, front-loaded, and every sentence earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no output schema, no annotations, and 5 parameters, the description is too brief. It explains default columns but omits how sorting, filtering, or backend selection works. A list tool benefits from more context (e.g., pagination, result structure).
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 60%, and the description only adds context about default columns. The schema already documents all parameters adequately. The description does not significantly enhance parameter understanding beyond what the schema provides.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action 'List' and the resource 'service groups', with a note about default columns. However, it does not differentiate from sibling list tools like thruk_list_hostgroups or thruk_list_services.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives, no exclusions, and no prerequisites mentioned. The description only states what the tool does without usage context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
thruk_list_servicesC
List monitored services.
| Name | Required | Description | Default |
|---|---|---|---|
| sort | No | Sort order: a column name, optionally prefixed with '-' for descending (e.g. 'name', '-last_check'); comma-separate multiple keys. Defaults to 'host_name,description'. | host_name,description |
| limit | No | ||
| filter | No | Structured filter tree supporting AND/OR nesting. Two node types: leaf: {"type":"leaf", "field":"...", "op":"...", "value":...} group: {"type":"group", "operator":"and"|"or", "conditions":[...]} Available fields: custom_var, description, host, host_custom_var, hostgroup, servicegroup, state Operators: eq, gte, in, lte, neq, regex Examples: # Hosts DOWN in HG_AGILE: {"type":"group","operator":"and","conditions":[ {"type":"leaf","field":"hostgroup","op":"eq","value":"HG_AGILE"}, {"type":"leaf","field":"state","op":"eq","value":"down"} ]} # Hosts in HG_AGILE OR with KERNEL=windows: {"type":"group","operator":"or","conditions":[ {"type":"leaf","field":"hostgroup","op":"eq","value":"HG_AGILE"}, {"type":"leaf","field":"custom_var","op":"eq","value":{"var":"KERNEL","val":"windows"}} ]} | |
| offset | No | ||
| columns | No | Comma-separated columns to return. Omit for a curated default set tuned for this tool; pass '' (empty string) to return all available columns. | |
| backends | No | Comma-separated backend names (sites). Omit for all backends. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description alone must disclose behavioral traits. It fails to mention pagination, authentication requirements, rate limits, or that it returns a list of services. The minimal phrase 'List monitored services' provides no behavioral context beyond the obvious.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise at four words, front-loading the core action. No wasted words, but could be expanded slightly to improve completeness without losing conciseness.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (6 parameters, nested filters, backends, no output schema), the description is woefully incomplete. It does not explain return format, default sorting, how to paginate, or the filter structure, leaving the agent underinformed.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema documents parameters like filter, sort, and columns with decent descriptions (67% coverage). However, the tool description adds zero value for parameters; it does not even hint at available filtering or sorting capabilities, leaving the agent to rely solely on the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description 'List monitored services' clearly states the verb 'list' and the resource 'monitored services', distinguishing it from sibling tools like thruk_list_hosts or thruk_list_comments. However, it does not elaborate on scope or specifics, preventing a top score.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives such as thruk_get_service (individual service) or thruk_list_alerts (alerts). The description lacks any context about appropriate use cases or exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
thruk_notification_heatmapB
Return notification counts grouped by time bucket over a window.
| Name | Required | Description | Default |
|---|---|---|---|
| since | No | Start of analysis window. Thruk relative time ("-2h", "-7d") or ISO datetime ("2026-05-21 14:00:00"). Default: last 24 h. | -24h |
| until | No | End of the time window (same formats as since). Default: now. | |
| bucket | No | Time bucket width: '15m', '30m', '1h' (default), '6h', '1d'. | 1h |
| filter | No | Structured filter tree supporting AND/OR nesting. Two node types: leaf: {"type":"leaf", "field":"...", "op":"...", "value":...} group: {"type":"group", "operator":"and"|"or", "conditions":[...]} Available fields: contact, custom_var, host, hostgroup, service, since, state, until Operators: eq, gte, in, lte, neq, regex The 'since'/'until' fields accept Thruk relative time ("-2h", "-7d") or ISO datetime ("2026-05-21 14:00:00"). Examples: # Hosts DOWN in HG_AGILE: {"type":"group","operator":"and","conditions":[ {"type":"leaf","field":"hostgroup","op":"eq","value":"HG_AGILE"}, {"type":"leaf","field":"state","op":"eq","value":"down"} ]} # Hosts in HG_AGILE OR with KERNEL=windows: {"type":"group","operator":"or","conditions":[ {"type":"leaf","field":"hostgroup","op":"eq","value":"HG_AGILE"}, {"type":"leaf","field":"custom_var","op":"eq","value":{"var":"KERNEL","val":"windows"}} ]} | |
| backends | No | Comma-separated backend names (sites). Omit for all backends. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must disclose behavior. It only states the output but doesn't mention side effects, permissions, rate limits, or what 'window' means precisely. It implies a read-only operation but doesn't confirm.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single, 12-word sentence efficiently conveys the core function. It is front-loaded with the action. However, it could be slightly improved by placing the grouping information earlier.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No output schema is provided, so the description should explain the return format (e.g., a map of time buckets to counts). It does not. For a tool with a complex filter parameter, the description does not compensate for missing output details.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so baseline 3. The description adds no new meaning beyond the schema; it merely summarizes the grouping already indicated by the 'bucket' parameter. However, it doesn't detract from the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('return'), resource ('notification counts'), and grouping ('by time bucket over a window'). It distinguishes from sibling tools like thruk_notifications (individual notifications) and thruk_notification_summary (aggregated but not necessarily time-bucketed).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives. For example, it doesn't differentiate from thruk_alert_heatmap or thruk_notification_summary. The agent must infer usage from the name alone.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
thruk_notificationsC
Enable or disable notifications for a host or service.
| Name | Required | Description | Default |
|---|---|---|---|
| host | Yes | Host name | |
| cascade | No | When true and no service is specified, also apply to all services of the host. Ignored when service is set. | |
| enabled | Yes | True to enable notifications, False to disable. | |
| service | No | Service description. Omit to target the host only (use cascade=true to also cover all its services). | |
| backends | No | Comma-separated backend names (sites). Omit for all backends. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries full burden. It only states the basic action, without disclosing any behavioral traits such as whether changes are immediate, reversible, or require specific permissions.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single short sentence, achieving conciseness. However, it could include slightly more detail without becoming verbose, but remains efficient.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With 5 parameters and no output schema, the description is too brief. It does not explain the interplay of parameters like cascade and backends, leaving the agent to infer behavior from the schema alone.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline is 3. The description does not add any extra meaning beyond the schema, which already describes parameters like cascade and backends adequately.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action (enable/disable) and the resource (notifications for a host or service). It is distinct from sibling tools like thruk_acknowledge, but does not explicitly differentiate itself.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no guidance on when to use this tool versus alternatives like thruk_acknowledge or thruk_schedule_downtime. No context about prerequisites or typical use cases is provided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
thruk_notification_summaryC
Count notifications grouped by a single dimension over a time window.
| Name | Required | Description | Default |
|---|---|---|---|
| since | No | Start of analysis window. Thruk relative time ("-2h", "-7d") or ISO datetime ("2026-05-21 14:00:00"). Default: last 24 h. | -24h |
| until | No | End of the time window (same formats as since). Default: now. | |
| filter | No | Structured filter tree supporting AND/OR nesting. Two node types: leaf: {"type":"leaf", "field":"...", "op":"...", "value":...} group: {"type":"group", "operator":"and"|"or", "conditions":[...]} Available fields: contact, custom_var, host, hostgroup, service, since, state, until Operators: eq, gte, in, lte, neq, regex The 'since'/'until' fields accept Thruk relative time ("-2h", "-7d") or ISO datetime ("2026-05-21 14:00:00"). Examples: # Hosts DOWN in HG_AGILE: {"type":"group","operator":"and","conditions":[ {"type":"leaf","field":"hostgroup","op":"eq","value":"HG_AGILE"}, {"type":"leaf","field":"state","op":"eq","value":"down"} ]} # Hosts in HG_AGILE OR with KERNEL=windows: {"type":"group","operator":"or","conditions":[ {"type":"leaf","field":"hostgroup","op":"eq","value":"HG_AGILE"}, {"type":"leaf","field":"custom_var","op":"eq","value":{"var":"KERNEL","val":"windows"}} ]} | |
| backends | No | Comma-separated backend names (sites). Omit for all backends. | |
| group_by | No | Dimension to group notification counts by: 'contact' (default), 'host', 'service', 'state', 'command', 'hostgroup' or 'servicegroup' (the last two: ventilation par client). | contact |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries full burden. It only states the action, omitting behavioral details such as read-only nature, permissions, rate limits, or output format. For a tool that performs aggregation, it adds no insight beyond the name.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single concise sentence that front-loads the core action. It is appropriately sized for a tool with well-documented parameters, though it could benefit from a secondary sentence on output or usage distinction.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has 5 parameters and no output schema, the description is minimal. It explains the counting and grouping but does not describe the output structure or indicate that the result is a mapping from dimension values to counts. The schema covers parameters well, but the description could be more complete about the return value.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% (all 5 parameters have descriptions in the input schema). The tool description itself adds no parameter semantics; it repeats 'single dimension' which is already covered by the group_by parameter description. Baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description 'Count notifications grouped by a single dimension over a time window' clearly states the action (count), resource (notifications), and the grouping aspect, which distinguishes it from sibling tools that list notifications or provide heatmaps. However, it could be more explicit about being an aggregation vs. a raw list, which would differentiate it further.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool vs. alternatives like thruk_notifications or thruk_list_notifications. It does not mention contexts where counting is preferred over listing, nor does it specify when not to use it (e.g., when raw data is needed).
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
thruk_oldest_problemsB
Unhandled problems sorted by age (oldest first).
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Maximum number of results (default 20). | |
| filter | No | Structured filter tree supporting AND/OR nesting. Two node types: leaf: {"type":"leaf", "field":"...", "op":"...", "value":...} group: {"type":"group", "operator":"and"|"or", "conditions":[...]} Available fields: custom_var, hostgroup Operators: eq, gte, in, lte, neq, regex Examples: # Objects in HG_AGILE: {"type":"leaf","field":"hostgroup","op":"eq","value":"HG_AGILE"} # In HG_AGILE OR with KERNEL=windows: {"type":"group","operator":"or","conditions":[ {"type":"leaf","field":"hostgroup","op":"eq","value":"HG_AGILE"}, {"type":"leaf","field":"custom_var","op":"eq","value":{"var":"KERNEL","val":"windows"}} ]} | |
| backends | No | Comma-separated backend names (sites). Omit for all backends. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden of behavioral disclosure. It states it returns sorted unhandled problems but does not disclose whether the results are limited, how pagination works, or any side effects. The existence of a 'limit' parameter is not mentioned in the description.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence that conveys the core purpose concisely and front-loads important information. There is no redundancy or wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the high schema coverage and no output schema, the description adequately captures the basic functionality. However, it lacks context on what constitutes a 'problem' (e.g., host vs service issues) and does not explain the sorting beyond 'oldest first'. It is minimally complete but could be improved.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with all three parameters (limit, filter, backends) described in the schema. The description does not add any additional meaning or usage hints for the parameters, so it meets the baseline but does not exceed it.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it retrieves 'unhandled problems' and sorts them by age (oldest first). This is specific and uses a verb-noun structure. However, it does not differentiate itself from sibling tools like 'thruk_problems', which may have a similar purpose.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives. There is no mention of prerequisites, exclusions, or complementary tools. The description only states what it does, not when it should be chosen.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
thruk_perfdata_near_thresholdC
Metrics within within_percent %% of breaching their warn/crit range.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Maximum number of services to scan (max 1000). | |
| filter | No | Structured filter tree supporting AND/OR nesting. Two node types: leaf: {"type":"leaf", "field":"...", "op":"...", "value":...} group: {"type":"group", "operator":"and"|"or", "conditions":[...]} Available fields: custom_var, description, host, host_custom_var, hostgroup, servicegroup, state Operators: eq, gte, in, lte, neq, regex Examples: # Hosts DOWN in HG_AGILE: {"type":"group","operator":"and","conditions":[ {"type":"leaf","field":"hostgroup","op":"eq","value":"HG_AGILE"}, {"type":"leaf","field":"state","op":"eq","value":"down"} ]} # Hosts in HG_AGILE OR with KERNEL=windows: {"type":"group","operator":"or","conditions":[ {"type":"leaf","field":"hostgroup","op":"eq","value":"HG_AGILE"}, {"type":"leaf","field":"custom_var","op":"eq","value":{"var":"KERNEL","val":"windows"}} ]} | |
| backends | No | Comma-separated backend names (sites). Omit for all backends. | |
| within_percent | No | Proximity threshold in percent. A metric is returned when its value is within this percentage of breaching its warn (or crit) range, or already breached (headroom 0). |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It does not disclose behavioral traits such as whether the operation is read-only, what scoping is applied (hosts vs services), or potential performance impact. The description is too brief to inform the agent beyond the basic function.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is very short but lacks structure and clarity. It uses unconventional formatting (double backticks and percent signs) which may hinder readability. While concise, it sacrifices completeness and effective communication.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has four parameters, no output schema, and no annotations, the description is insufficient. It does not explain return format, pagination, performance implications, or how the results relate to the filter parameter. A more comprehensive description is needed for the agent to use this tool correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema covers all four parameters with detailed descriptions (coverage 100%). The tool description only repeats the 'within_percent' parameter name without adding new meaning. Per the guidance, baseline 3 is appropriate since the schema does the heavy lifting.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool returns metrics near threshold values, referencing the 'within_percent' parameter. It is specific enough and distinguishes this tool from general perfdata retrieval tools like 'thruk_perfdata_snapshot'. However, the use of backticks and double percent signs may be confusing.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives such as 'thruk_perfdata_snapshot' or 'thruk_get_perfdata'. The description lacks context on prerequisites, limitations, or recommended use cases.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
thruk_perfdata_snapshotC
Parsed performance data for every service matching filter (one call).
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Maximum number of services to scan (max 1000). | |
| filter | No | Structured filter tree supporting AND/OR nesting. Two node types: leaf: {"type":"leaf", "field":"...", "op":"...", "value":...} group: {"type":"group", "operator":"and"|"or", "conditions":[...]} Available fields: custom_var, description, host, host_custom_var, hostgroup, servicegroup, state Operators: eq, gte, in, lte, neq, regex Examples: # Hosts DOWN in HG_AGILE: {"type":"group","operator":"and","conditions":[ {"type":"leaf","field":"hostgroup","op":"eq","value":"HG_AGILE"}, {"type":"leaf","field":"state","op":"eq","value":"down"} ]} # Hosts in HG_AGILE OR with KERNEL=windows: {"type":"group","operator":"or","conditions":[ {"type":"leaf","field":"hostgroup","op":"eq","value":"HG_AGILE"}, {"type":"leaf","field":"custom_var","op":"eq","value":{"var":"KERNEL","val":"windows"}} ]} | |
| backends | No | Comma-separated backend names (sites). Omit for all backends. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description should disclose behavioral traits. It only mentions 'one call' and 'parsed performance data,' omitting details on side effects, read-only status, pagination, or rate limits.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise, using a single sentence. While efficient, it lacks structured presentation, but no words are wasted.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Despite detailed parameter schema, the description fails to explain what 'parsed performance data' entails, return format, or any limitations (e.g., max 1000 limit). This is insufficient for a tool with no output schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 100% description coverage, so parameters are already well-documented. The tool description adds no extra semantic meaning beyond what the schema provides.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it returns 'parsed performance data' for services matching a filter, and notes it's a single call. However, it does not differentiate from similar sibling tools like thruk_get_perfdata.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives. The phrase 'one call' hints at efficiency but lacks explicit when-to-use or when-not-to-use context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
thruk_problem_countsB
Flat aggregate of unhealthy-state counts across hosts and services.
| Name | Required | Description | Default |
|---|---|---|---|
| filter | No | Structured filter tree supporting AND/OR nesting. Two node types: leaf: {"type":"leaf", "field":"...", "op":"...", "value":...} group: {"type":"group", "operator":"and"|"or", "conditions":[...]} Available fields: custom_var, hostgroup, servicegroup Operators: eq, gte, in, lte, neq, regex Examples: # Objects in HG_AGILE: {"type":"leaf","field":"hostgroup","op":"eq","value":"HG_AGILE"} # In HG_AGILE OR with KERNEL=windows: {"type":"group","operator":"or","conditions":[ {"type":"leaf","field":"hostgroup","op":"eq","value":"HG_AGILE"}, {"type":"leaf","field":"custom_var","op":"eq","value":{"var":"KERNEL","val":"windows"}} ]} | |
| backends | No | Comma-separated backend names (sites). Omit for all backends. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must fully disclose behaviors. It does not explain what constitutes 'unhealthy,' how counts are aggregated (separate or combined), or any permissions/rate limits. Only a brief summary is given.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is one sentence of 11 words, very concise and front-loaded. While it could include more detail, it wastes no words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the complexity of the filter parameter and no output schema, the description is too brief. It does not explain the return format or what the aggregate looks like, leaving gaps for the agent.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already details both parameters. The tool description adds no extra meaning beyond what the schema provides, so baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it provides a flat aggregate of unhealthy-state counts across hosts and services. It distinguishes from siblings like thruk_problems (which lists problems) and thruk_totals (general totals).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No explicit guidance on when to use this tool versus alternatives. The description does not mention prerequisites or comparison to other tools like thruk_problems or thruk_totals.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
thruk_problemsB
List all current unhandled host/service problems (not acknowledged, not in downtime).
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | ||
| filter | No | Structured filter tree supporting AND/OR nesting. Two node types: leaf: {"type":"leaf", "field":"...", "op":"...", "value":...} group: {"type":"group", "operator":"and"|"or", "conditions":[...]} Available fields: custom_var, host_custom_var, hostgroup, state Operators: eq, gte, in, lte, neq, regex Examples: # Hosts DOWN in HG_AGILE: {"type":"group","operator":"and","conditions":[ {"type":"leaf","field":"hostgroup","op":"eq","value":"HG_AGILE"}, {"type":"leaf","field":"state","op":"eq","value":"down"} ]} # Hosts in HG_AGILE OR with KERNEL=windows: {"type":"group","operator":"or","conditions":[ {"type":"leaf","field":"hostgroup","op":"eq","value":"HG_AGILE"}, {"type":"leaf","field":"custom_var","op":"eq","value":{"var":"KERNEL","val":"windows"}} ]} | |
| offset | No | ||
| columns | No | Comma-separated columns to return. Omit for a curated default set tuned for this tool; pass '' (empty string) to return all available columns. | |
| backends | No | Comma-separated backend names (sites). Omit for all backends. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden. It correctly implies a read-only operation ('List') and discloses the default scope (unhandled, not acknowledged, not in downtime). However, it does not mention rate limits, authentication requirements, or any other behavioral details.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, front-loaded sentence. It conveys the essential information without any wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given that the tool has 5 parameters and no output schema, the description is too sparse. It does not explain pagination (limit/offset), filtering, column selection, or backend specification. For a list tool, an agent would need such context to use it effectively.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema covers 60% of parameters, but the description adds no meaning to any parameter. Parameters like 'filter', 'columns', and 'offset' are documented only in the schema. The description does not explain how to use them or relate them to the tool's purpose.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('List'), the resource ('all current unhandled host/service problems'), and explicitly defines 'unhandled' as 'not acknowledged, not in downtime'. This distinguishes it from similar tools like thruk_oldest_problems or thruk_problem_counts.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives. There are many sibling tools (e.g., thruk_oldest_problems, thruk_problem_counts) with overlapping purposes, but no when-to-use or when-not-to-use information is given.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
thruk_queryA
Escape hatch: call any Thruk REST endpoint. path is everything after /thruk/r
| Name | Required | Description | Default |
|---|---|---|---|
| data | No | ||
| path | Yes | Path after /thruk/r, e.g. /hosts/srv01/services | |
| method | No | ||
| params | No | ||
| backends | No | Comma-separated backend names (sites). Omit for all backends. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, and the description offers no information about behavioral traits such as authentication, rate limits, or potential side effects. For a tool that can invoke arbitrary endpoints, this is a significant gap.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise with two short sentences, containing no filler words. Every word adds value.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With five parameters, no output schema, and the tool being a catch-all for arbitrary endpoints, the description is too minimal. It lacks guidance on how to use the method, data, and params parameters effectively.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 40%; only the 'path' and 'backends' parameters have descriptions in the schema. The description adds meaning to 'path' but does not explain 'data', 'method', or 'params'.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool is an escape hatch for calling any Thruk REST endpoint, with a specific instruction on the path parameter. This distinguishes it from the many sibling tools that target specific operations.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The term 'escape hatch' implies use when no specific tool exists, but the description does not explicitly state when to use it vs. alternatives or when to avoid it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
thruk_recent_eventsC
Return the most recent monitoring events from the last N hours (default 1 h).
| Name | Required | Description | Default |
|---|---|---|---|
| hours | No | ||
| limit | No | ||
| filter | No | Structured filter tree supporting AND/OR nesting. Two node types: leaf: {"type":"leaf", "field":"...", "op":"...", "value":...} group: {"type":"group", "operator":"and"|"or", "conditions":[...]} Available fields: custom_var, host, hostgroup, message, service, since, until Operators: eq, gte, in, lte, neq, regex The 'since'/'until' fields accept Thruk relative time ("-2h", "-7d") or ISO datetime ("2026-05-21 14:00:00"). Examples: # Log entries matching a pattern since -2h: {"type":"group","operator":"and","conditions":[ {"type":"leaf","field":"message","op":"regex","value":"DISK.*CRITICAL"}, {"type":"leaf","field":"since","op":"gte","value":"-2h"} ]} | |
| offset | No | ||
| columns | No | Comma-separated columns to return. Omit for a curated default set tuned for this tool; pass '' (empty string) to return all available columns. | |
| backends | No | Comma-separated backend names (sites). Omit for all backends. | |
| only_alerts | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries full burden for behavioral disclosure. It only mentions the time range, omitting key behaviors such as sorting (implicitly most recent first?), pagination (though parameters limit/offset exist), data freshness, or side effects. For a 7-parameter tool, this is insufficient.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single concise sentence (14 words), front-loading the core purpose. While efficient, it could include more context without losing clarity, such as the default limit or filter capabilities.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the complexity (7 parameters, no output schema, no annotations), the description is incomplete. It fails to summarize what events are returned, how filtering works (despite complex filter schema), or any output format details. The schema provides structure, but the description doesn't integrate it.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 43%, yet the tool description adds no parameter explanations. The description does not address any of the 7 parameters (hours, limit, filter, offset, columns, backends, only_alerts). The schema contains some parameter descriptions, but the tool description itself adds zero value for parameter understanding.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool returns recent monitoring events with a configurable time window (default 1 hour). The verb 'Return' and resource 'monitoring events' are specific. However, it does not explicitly differentiate from sibling tools like thruk_list_alerts or thruk_problems, which also list events.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for recent events by specifying the default time window, but it provides no explicit guidance on when to use this tool vs alternatives (e.g., thruk_list_logs, thruk_problems). No exclusions or prerequisites are mentioned.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
thruk_recheckC
Schedule an immediate (re)check for a host or service.
| Name | Required | Description | Default |
|---|---|---|---|
| host | Yes | Host name | |
| forced | No | ||
| service | No | ||
| backends | No | Comma-separated backend names (sites). Omit for all backends. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It says 'immediate (re)check' but does not disclose side effects, required permissions, or the impact of the 'forced' parameter. The tool likely performs a write operation, but this is not stated.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single concise sentence, which is efficient. However, it could be restructured to include key parameter context without sacrificing brevity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has 4 parameters and no output schema, the description is too terse. It lacks information on return values, expected behavior for different parameter combinations, and how it fits among many sibling tools. An agent would need supplementary knowledge to use it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description adds no meaning beyond the schema. Schema coverage is 50% (only 'backends' has a description). The description does not explain 'forced', 'host', or 'service' parameters. The phrase 'host or service' hints at the 'service' parameter but does not clarify its optionality or default.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'Schedule' and the resource 'immediate (re)check for a host or service.' It provides a specific action but does not differentiate it explicitly from sibling tools like thruk_schedule_downtime, though the action is distinct.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description offers no guidance on when to use this tool versus alternatives. It does not mention prerequisites, caveats, or comparison to sibling tools. For example, it does not clarify that this is for immediate rechecking rather than scheduling downtime.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
thruk_recurring_problemsA
Return hosts/services that generated repeated alerts over a time window.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Maximum number of results (default 10). | |
| since | No | Start of analysis window. Thruk relative time ("-2h", "-7d") or ISO datetime ("2026-05-21 14:00:00"). Default: last 24 h. | -24h |
| until | No | End of the time window (same formats as since). Default: now. | |
| filter | No | Structured filter tree supporting AND/OR nesting. Two node types: leaf: {"type":"leaf", "field":"...", "op":"...", "value":...} group: {"type":"group", "operator":"and"|"or", "conditions":[...]} Available fields: custom_var, host, hostgroup, service Operators: eq, gte, in, lte, neq, regex Examples: # Objects in HG_AGILE: {"type":"leaf","field":"hostgroup","op":"eq","value":"HG_AGILE"} # In HG_AGILE OR with KERNEL=windows: {"type":"group","operator":"or","conditions":[ {"type":"leaf","field":"hostgroup","op":"eq","value":"HG_AGILE"}, {"type":"leaf","field":"custom_var","op":"eq","value":{"var":"KERNEL","val":"windows"}} ]} | |
| backends | No | Comma-separated backend names (sites). Omit for all backends. | |
| min_alerts | No | Minimum number of non-recovery alert events to be included (default 5). |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, so the description carries full burden. It clearly states a read-only operation (returning data) with no destructive hints. No contradictions.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence, no wasted words. Efficiently conveys the core functionality.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no output schema, the description could mention the return format (e.g., list with alert counts). However, the tool is simple, and the description covers the basic purpose adequately.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so baseline is 3. The description does not add additional meaning beyond the schema; it only restates the tool's purpose.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description 'Return hosts/services that generated repeated alerts over a time window' uses a specific verb ('return') and resource ('hosts/services with repeated alerts'), clearly distinguishing it from sibling tools like thruk_alert_heatmap or thruk_oldest_problems.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No explicit guidance on when to use this tool versus alternatives. The description implies it is for recurrent problems, but lacks direct when-not or alternative references.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
thruk_reliability_reportB
Per host/service reliability metrics (MTTR / MTBF / incidents) from the log.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Maximum number of host/service objects to return (busiest first, default 50). | |
| since | No | Start of analysis window. Thruk relative time ("-30d", "-7d") or ISO datetime ("2026-05-21 14:00:00"). Default: last 30 days. | -30d |
| until | No | End of the time window (same formats as since). Default: now. | |
| filter | No | Structured filter tree supporting AND/OR nesting. Two node types: leaf: {"type":"leaf", "field":"...", "op":"...", "value":...} group: {"type":"group", "operator":"and"|"or", "conditions":[...]} Available fields: custom_var, host, hostgroup, service Operators: eq, gte, in, lte, neq, regex Examples: # Objects in HG_AGILE: {"type":"leaf","field":"hostgroup","op":"eq","value":"HG_AGILE"} # In HG_AGILE OR with KERNEL=windows: {"type":"group","operator":"or","conditions":[ {"type":"leaf","field":"hostgroup","op":"eq","value":"HG_AGILE"}, {"type":"leaf","field":"custom_var","op":"eq","value":{"var":"KERNEL","val":"windows"}} ]} | |
| backends | No | Comma-separated backend names (sites). Omit for all backends. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, so description carries full burden. It says 'from the log,' implying a read-only operation, but does not explicitly state side effects, performance implications, or limitations. This is adequate but not thorough.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single efficient sentence, but it is too short given the complexity of the tool. It could include a brief note on output or usage context without sacrificing front-loading.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No output schema provided. The description does not explain the format of the returned reliability metrics, ordering (busiest first implied by limit description but not stated), or aggregation level. This leaves ambiguity for agent invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% with thorough parameter descriptions (e.g., filter with examples). The tool description adds no extra meaning beyond the schema, so baseline score of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool provides per host/service reliability metrics (MTTR, MTBF, incidents) from logs. This uniquely distinguishes it from sibling tools like thruk_incident_timeline which focuses on timeline of incidents, not aggregated metrics.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives. The description does not mention prerequisites, exclusions, or typical use cases, leaving the agent to infer from the tool name alone.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
thruk_remove_acknowledgementC
Remove an acknowledgement.
| Name | Required | Description | Default |
|---|---|---|---|
| host | Yes | ||
| service | No | ||
| backends | No | Comma-separated backend names (sites). Omit for all backends. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, so description must disclose behavioral traits. It only says 'remove' with no info on side effects, permissions, required state, or whether removal is permanent. Barely any transparency.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is one short sentence, which is concise but lacks any structure (e.g., usage notes). It could be expanded without losing conciseness to include parameter usage or context.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has 3 parameters (one required), no output schema, and no annotations, the description is severely incomplete. It does not explain how to use the parameters, what the outcome is, or any prerequisites. Completely inadequate for an effective agent invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 33% (only backends has a description). The description itself does not explain the role of host and service parameters, nor how they identify the acknowledgement. With low coverage, description should compensate but does not.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description 'Remove an acknowledgement.' states the verb and object, but is vague about scope (host vs service) and does not distinguish from siblings like thruk_acknowledge or thruk_stale_acks. It is minimally clear but lacks specificity.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives. No context on prerequisites (e.g., acknowledgement must exist) or conditions. Sibling tools like thruk_acknowledge and thruk_bulk_acknowledge are present but not referenced.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
thruk_root_causeB
Collapse a DOWN/UNREACHABLE storm into its root cause(s) via parent topology.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Maximum hosts scanned when building the parent topology map (default 5000). | |
| since | No | Start of analysis window. Thruk relative time ("-2h", "-7d") or ISO datetime ("2026-05-20 14:00:00"). Default: last 1 hour. | -1h |
| until | No | End of the time window (same formats as since). Default: now. | |
| filter | No | Structured filter tree supporting AND/OR nesting. Two node types: leaf: {"type":"leaf", "field":"...", "op":"...", "value":...} group: {"type":"group", "operator":"and"|"or", "conditions":[...]} Available fields: custom_var, host, hostgroup Operators: eq, gte, in, lte, neq, regex Examples: # Objects in HG_AGILE: {"type":"leaf","field":"hostgroup","op":"eq","value":"HG_AGILE"} # In HG_AGILE OR with KERNEL=windows: {"type":"group","operator":"or","conditions":[ {"type":"leaf","field":"hostgroup","op":"eq","value":"HG_AGILE"}, {"type":"leaf","field":"custom_var","op":"eq","value":{"var":"KERNEL","val":"windows"}} ]} | |
| backends | No | Comma-separated backend names (sites). Omit for all backends. | |
| sample_limit | No | Maximum hosts listed per cluster in 'impacted_hosts' (default 50). |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description must disclose behavioral traits. It only states the core action but omits safety (read-only vs. mutation), return format, or side effects (like reading topology data). The phrase 'collapse' could imply data transformation or grouping, but it's not clarified.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single sentence that gets the point across without fluff. It is concise, though it could benefit from a second sentence to improve completeness.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given 6 parameters and no output schema, the description is insufficient. It fails to explain what 'collapse' means architecturally, what the output looks like (e.g., a list of root cause hosts), or how filtering interacts with the storm concept.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so baseline 3 is appropriate. The description adds no parameter details beyond the name; the schema itself provides adequate descriptions for all 6 parameters.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Collapse') and resource ('DOWN/UNREACHABLE storm') and method ('via parent topology'), clearly distinguishing it from other Thruk tools like thruk_problems or thruk_concurrent_failures.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool vs alternatives. The description does not mention prerequisites, scenario, or exclude situations where other tools are better.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
thruk_run_background_queryC
Run a potentially long Thruk REST request via the background=1 mechanism.
| Name | Required | Description | Default |
|---|---|---|---|
| data | No | ||
| path | Yes | Path after /thruk/r | |
| method | No | ||
| params | No | ||
| backends | No | Comma-separated backend names (sites). Omit for all backends. | |
| poll_timeout | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries full burden. It mentions background=1 mechanism but does not explain how the result is retrieved (polling, job ID, etc.), whether it blocks, timeout behavior, or what happens on failure. The poll_timeout parameter suggests polling but is not described.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single concise sentence. It is front-loaded with the core action and mechanism, but could be improved by adding structured details on usage and behavior without sacrificing conciseness.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has 6 parameters, async behavior (background=1), no output schema, and a potential poll_timeout, the description is too brief. It lacks information on how to use the tool effectively, what the response looks like, and how polling works.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 33% (only path and backends have descriptions). The description adds no additional meaning to parameters; it does not explain data, method, params, or poll_timeout beyond default values. It fails to compensate for the low coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool runs long Thruk REST requests via background=1 mechanism. It identifies the purpose (execute long queries) and the mechanism (background=1), but does not explicitly differentiate from thruk_query or other query tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description mentions 'potentially long' implying use for long-running requests, but provides no explicit guidance on when to use this tool versus alternatives like thruk_query, no prerequisites, and no exclusion criteria.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
thruk_schedule_downtimeC
Schedule a host or service downtime (times accept 'now', relative '+2h'/'+30m', or ISO 8601).
| Name | Required | Description | Default |
|---|---|---|---|
| host | Yes | Host name | |
| fixed | No | ||
| author | No | ||
| comment | No | ||
| service | No | ||
| backends | No | Comma-separated backend names (sites). Omit for all backends. | |
| end_time | No | ||
| start_time | No | ||
| duration_minutes | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description mentions accepted time formats ('now', relative, ISO 8601) but omits other behavioral traits like permissions required, return value, or side effects. Without annotations, more detail is needed.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is very concise at 17 words, but efficiency compromises informativeness. It could be expanded without losing structure.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With 9 parameters and no output schema, the description is too sparse to guide an agent effectively. It lacks details on how to construct a downtime, what success looks like, and error conditions.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is only 22%, and the description adds no parameter explanations beyond time formats. Parameters like fixed, author, comment, and duration_minutes are left unexplained.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool schedules downtime for a host or service. However, it does not differentiate from sibling tools like thruk_schedule_hostgroup_downtime or thruk_schedule_servicegroup_downtime.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives, nor any prerequisites or exclusions. The description merely states what it does without context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
thruk_schedule_hostgroup_downtimeC
Schedule a downtime on every host or service of a hostgroup.
| Name | Required | Description | Default |
|---|---|---|---|
| fixed | No | ||
| author | No | ||
| target | No | ||
| comment | No | ||
| backends | No | Comma-separated backend names (sites). Omit for all backends. | |
| end_time | No | ||
| hostgroup | Yes | Hostgroup name | |
| start_time | No | ||
| duration_minutes | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description provides minimal behavioral detail. It does not explain whether the downtime is immediate, how parameters like fixed and duration_minutes interact, or any side effects. The agent lacks transparency on what the tool actually does beyond the basic action.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, concise sentence. However, for a tool with 9 parameters, it is too brief and lacks structure (e.g., no bullet points or examples). It is acceptable but not optimally organized.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description is incomplete given the tool's complexity (9 parameters, no output schema, many sibling tools). It fails to explain how to use the parameters, what the return value is, or how this tool differs from other scheduling tools.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Only 22% of parameters have schema descriptions (hostgroup and backends). The tool description adds no additional parameter meaning, leaving the agent to infer the purpose of fields like target, author, or duration_minutes from names alone.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool schedules downtime on every host or service of a hostgroup, using a specific verb and resource that distinguishes it from siblings like thruk_schedule_downtime or thruk_schedule_servicegroup_downtime.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternative scheduling tools (e.g., for single objects or propagated downtimes). The description does not mention prerequisites, context, or exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
thruk_schedule_host_services_downtimeB
Schedule a downtime on ALL services of the given host (not the host object itself).
| Name | Required | Description | Default |
|---|---|---|---|
| host | Yes | Host name | |
| fixed | No | ||
| author | No | ||
| comment | No | ||
| backends | No | Comma-separated backend names (sites). Omit for all backends. | |
| end_time | No | ||
| start_time | No | ||
| duration_minutes | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description bears full responsibility for behavioral disclosure. It only states the scope ('ALL services of the given host') and what it does not do ('not the host object itself'). It omits details on auth requirements, reversibility, or impact on monitoring, leaving significant gaps.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, clear sentence that conveys the essential purpose with no fluff. It is appropriately concise and front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has 8 parameters and no output schema or annotations, the description is too brief. It does not cover how to specify the downtime window (start/end vs duration), the meaning of 'fixed', or how to use the backends parameter. The description leaves the agent with insufficient context to invoke the tool correctly without relying solely on the schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is only 25% (2 of 8 parameters have descriptions), but the tool description adds no additional parameter information. It does not explain required parameters (host) or optional parameters like start_time, end_time, duration, fixed, author, comment, or backends, which would significantly aid parameter selection.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('Schedule a downtime'), the target ('ALL services of the given host'), and explicitly excludes the host object itself, distinguishing it from related tools like thruk_schedule_downtime and thruk_schedule_propagated_host_downtime.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies when to use this tool (downtime on all services of a host, not the host) and differentiates from alternatives by noting it schedules on services only. It does not explicitly state when not to use it, but the context from sibling tools provides some guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
thruk_schedule_propagated_host_downtimeC
Schedule a downtime on a host and propagate to all child hosts.
| Name | Required | Description | Default |
|---|---|---|---|
| host | Yes | Host name | |
| fixed | No | ||
| author | No | ||
| comment | No | ||
| backends | No | Comma-separated backend names (sites). Omit for all backends. | |
| end_time | No | ||
| triggered | No | ||
| start_time | No | ||
| duration_minutes | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations exist; the description only states the action without disclosing behavioral traits such as authorization needs, reversibility, or side effects. 'Schedule' implies a state change but lacks detail.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, concise sentence that quickly conveys the core functionality. However, it could include more detail without becoming overly long.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (9 parameters, many siblings, no output schema), the description is too minimal. It lacks information on parameter usage, return values, and behavioral nuances beyond propagation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 9 parameters and only 22% schema description coverage, the description adds no meaning to parameters like start_time, end_time, or duration_minutes. The schema's minimal descriptions are not supplemented.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'schedule' and the resource 'downtime on a host', with the specific scope of propagating to all child hosts, distinguishing it from sibling tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives like thruk_schedule_downtime or thruk_schedule_hostgroup_downtime. No prerequisites or context for use are provided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
thruk_schedule_servicegroup_downtimeC
Schedule a downtime on a servicegroup's services or owning hosts.
| Name | Required | Description | Default |
|---|---|---|---|
| fixed | No | ||
| author | No | ||
| target | No | ||
| comment | No | ||
| backends | No | Comma-separated backend names (sites). Omit for all backends. | |
| end_time | No | ||
| start_time | No | ||
| servicegroup | Yes | Servicegroup name | |
| duration_minutes | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided. The description only gives a high-level action without disclosing behavioral traits such as whether it is destructive, required permissions, side effects, or how downtime is applied (e.g., immediate or scheduled). The burden falls entirely on the description, which is insufficient.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise (one sentence) with no wasted words, but it lacks structure (e.g., no bullet points or sections). It is minimally acceptable but could benefit from additional context without becoming verbose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given 9 parameters and no output schema, the description is incomplete. It does not explain how start_time/end_time or duration_minutes interact, or how comments are used. The agent lacks sufficient context to use the tool correctly without external knowledge.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is low (22%), with only servicegroup and backends having descriptions. The tool description does not add meaning for the other 7 parameters (fixed, author, target, comment, end_time, start_time, duration_minutes). The agent must infer from names, which is ambiguous.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action (schedule a downtime) and the target (servicegroup's services or owning hosts). It distinguishes from sibling tools focused on hosts or hostgroups, though 'or' introduces slight ambiguity.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives like thruk_schedule_downtime or thruk_schedule_hostgroup_downtime. The description does not specify conditions, prerequisites, or context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
thruk_service_availabilityB
Compute availability (uptime / SLA %) for a service over a configurable time window.
| Name | Required | Description | Default |
|---|---|---|---|
| host | Yes | Host name | |
| since | No | Start of analysis window. Thruk relative time ("-7d", "-1m") or ISO datetime ("2026-05-01 00:00:00"). Default: last 7 days. Ignored when ``timeperiod`` is set. | -7d |
| until | No | End of analysis window (same formats as ``since``). Defaults to now. Ignored when ``timeperiod`` is set. | |
| service | Yes | Service description | |
| backends | No | Comma-separated backend names (sites). Omit for all backends. | |
| timeperiod | No | Thruk-native time period shortcut: "last24hours", "lastweek", "lastmonth", "thismonth", etc. Overrides ``since``/``until`` when provided. | |
| with_downtimes | No | Count scheduled downtime periods as outages (withdowntimes=1). | |
| include_soft_states | No | Include soft state changes in calculations (includesoftstates=1). |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided. The description only states what the tool computes without disclosing behavioral traits such as side effects, performance implications, or required permissions. For a compute-heavy tool, this is insufficient.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence that concisely captures the core functionality and its main configurable aspect (time window). It is front-loaded with the key verb and resource.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With 8 parameters and no output schema, the description lacks context on the return format, calculation details, or how parameters like `with_downtimes` affect results. It is too brief to be fully informative.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the description does not need to add parameter details. The description adds no extra meaning beyond what the input schema already provides, achieving baseline adequacy.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb 'Compute' and clearly identifies the resource 'availability for a service' with output type 'uptime / SLA %' and configurable time window. This distinguishes it from sibling tools like thruk_host_availability or thruk_hostgroup_availability which operate on different resource types.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for service-level availability computations but provides no explicit guidance on when to use this tool versus alternative tools (e.g., host or hostgroup availability) or when not to use it. No context about prerequisites or limitations is given.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
thruk_sitesA
List configured Thruk backends (sites).
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, and the description does not disclose any behavioral traits such as read-only nature, authentication requirements, or side effects. For a list operation, it is likely safe but not stated.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, clear sentence with no extraneous words. It is concisely front-loaded with the essential purpose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple parameterless tool, the description covers the basic purpose. However, without an output schema, the agent may lack information about the return format, which could be a minor gap.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters, so no parameter semantics are needed. The description adds value by specifying the resource being listed, which is sufficient.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states it lists configured Thruk backends (sites). Verb 'list' and resource 'configured Thruk backends' are specific and distinguish it from sibling list tools that focus on hosts, services, groups, etc.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No explicit guidance on when to use this tool versus alternatives like thruk_list_hosts or thruk_backend_health. Usage is implied by the tool's name and description, but lacks when-not-to-use or context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
thruk_stale_acksC
Acknowledgements older than N days (potentially forgotten ones).
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Maximum number of results (default 100). | |
| filter | No | Structured filter tree supporting AND/OR nesting. Two node types: leaf: {"type":"leaf", "field":"...", "op":"...", "value":...} group: {"type":"group", "operator":"and"|"or", "conditions":[...]} Available fields: custom_var, hostgroup Operators: eq, gte, in, lte, neq, regex Examples: # Objects in HG_AGILE: {"type":"leaf","field":"hostgroup","op":"eq","value":"HG_AGILE"} # In HG_AGILE OR with KERNEL=windows: {"type":"group","operator":"or","conditions":[ {"type":"leaf","field":"hostgroup","op":"eq","value":"HG_AGILE"}, {"type":"leaf","field":"custom_var","op":"eq","value":{"var":"KERNEL","val":"windows"}} ]} | |
| backends | No | Comma-separated backend names (sites). Omit for all backends. | |
| min_days | No | Minimum acknowledgement age in days (default 7). |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries full burden. It does not disclose that the tool is read-only, any required permissions, or what the response contains. The hint about 'potentially forgotten ones' is helpful but not sufficient for understanding behavioral traits like data mutability or side effects.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence, very concise. It front-loads the core concept. However, it could be restructured to explicitly state the verb and resource for even clearer communication.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No output schema is provided, and the description does not explain what the tool returns (e.g., a list of acknowledgements with fields). Given the tool retrieves data, this omission leaves the agent uncertain about the result format. The description also doesn't mention the significance of the default min_days value.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the schema already documents all parameters well. The description adds no extra semantics beyond what the schema provides. It implicitly references 'min_days' via 'older than N days', but this is also covered in the schema. Baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: listing acknowledgements older than N days. The phrase 'potentially forgotten ones' adds useful context. However, it could be more explicit by starting with a verb like 'List' instead of a noun phrase, which would improve clarity.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives like thruk_remove_acknowledgement or thruk_bulk_acknowledge. The agent must infer from the name and siblings, which is insufficient for effective selection.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
thruk_stale_checksC
Surface checks that stopped running (the dangerous "false green").
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Maximum number of rows scanned per object type (max 5000, default 500). | |
| filter | No | Structured filter tree supporting AND/OR nesting. Two node types: leaf: {"type":"leaf", "field":"...", "op":"...", "value":...} group: {"type":"group", "operator":"and"|"or", "conditions":[...]} Available fields: custom_var, hostgroup Operators: eq, gte, in, lte, neq, regex Examples: # Objects in HG_AGILE: {"type":"leaf","field":"hostgroup","op":"eq","value":"HG_AGILE"} # In HG_AGILE OR with KERNEL=windows: {"type":"group","operator":"or","conditions":[ {"type":"leaf","field":"hostgroup","op":"eq","value":"HG_AGILE"}, {"type":"leaf","field":"custom_var","op":"eq","value":{"var":"KERNEL","val":"windows"}} ]} | |
| backends | No | Comma-separated backend names (sites). Omit for all backends. | |
| grace_seconds | No | Absolute grace (seconds) added on top of interval*factor / passive_max_age_s to avoid boundary flapping (default 60). | |
| include_hosts | No | Also run the same logic over /hosts host checks (default true). | |
| include_disabled | No | Report active checks with active_checks_enabled=0 as reason=disabled (default true). | |
| staleness_factor | No | Multiplier on the active check_interval before a check is considered stale (now - last_check > interval*factor + grace_seconds). | |
| passive_max_age_s | No | Max age in seconds of a passive check's last result before reason=stale_passive (default 3600). | |
| latency_threshold_s | No | Latency in seconds above which a check is flagged with reason=high_latency. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, and the description does not disclose behavioral details such as configurability via parameters (staleness_factor, grace_seconds), that it can include hosts/disabled checks, or what the output contains.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence, no fluff. Front-loaded with core purpose, but somewhat under-specified for a tool with 9 parameters.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Tool has 9 parameters and no output schema, but description omits what the result looks like (e.g., a list of checks with reasons). Not complete enough for an agent to fully understand the tool's inputs/outputs.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with detailed parameter descriptions. The tool description adds no additional meaning beyond the schema, so baseline score of 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it surfaces checks that stopped running (false green), a specific verb+resource. It implies the tool's unique purpose, but doesn't explicitly distinguish from siblings like thruk_checks or thruk_oldest_problems.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives. No mention of prerequisites, exclusions, or intended context (e.g., for services vs hosts).
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
thruk_state_atB
Reconstruct the parc state at a past instant from /logs (post-mortem snapshot).
| Name | Required | Description | Default |
|---|---|---|---|
| filter | No | Structured filter tree supporting AND/OR nesting. Two node types: leaf: {"type":"leaf", "field":"...", "op":"...", "value":...} group: {"type":"group", "operator":"and"|"or", "conditions":[...]} Available fields: custom_var, host, hostgroup, service Operators: eq, gte, in, lte, neq, regex Examples: # Objects in HG_AGILE: {"type":"leaf","field":"hostgroup","op":"eq","value":"HG_AGILE"} # In HG_AGILE OR with KERNEL=windows: {"type":"group","operator":"or","conditions":[ {"type":"leaf","field":"hostgroup","op":"eq","value":"HG_AGILE"}, {"type":"leaf","field":"custom_var","op":"eq","value":{"var":"KERNEL","val":"windows"}} ]} | |
| backends | No | Comma-separated backend names (sites). Omit for all backends. | |
| timestamp | No | Past instant to reconstruct (required). Thruk relative ("-2h") or absolute ("2026-06-16 15:45:00", interpreted as UTC). | |
| problems_only | No | Return only non-OK/UP objects (drops the OK/UP rows). Default false. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Without annotations, the description must carry the full burden. It hints at read-only behavior ('reconstruct from logs') but does not explicitly state that it does not modify state, or mention performance, data freshness, authentication, or limitations of log-based reconstruction.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence with no wasted words. Key elements verb, resource, source, and temporal aspect are front-loaded. Every word contributes.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no output schema and no annotations, the description is too brief for a complex tool with 4 parameters (including a nested filter tree). It does not describe return format, result size, dependencies (e.g., log retention), or performance considerations. Significant gaps remain.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the description does not need to explain parameters further. Baseline 3 applies. The description adds no parameter details, but the schema already provides adequate descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'Reconstruct' and the resource 'parc state', with a specific temporal scope ('past instant') and data source ('/logs'). It effectively distinguishes this tool from state-diff or list tools among siblings.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives. It does not mention conditions that make it appropriate (e.g., need for historical snapshots) or inappropriate (e.g., if live data is needed). No reference to sibling tools like thruk_state_diff or thruk_list_hosts.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
thruk_state_diffB
List what changed between two past instants t1 → t2 (replayed from /logs).
| Name | Required | Description | Default |
|---|---|---|---|
| t1 | No | First instant (required). Thruk relative ("-2h") or absolute ("2026-06-16 15:45:00", UTC). Order is normalised to earlier→later. | |
| t2 | No | Second instant (required, same formats as t1). | |
| filter | No | Structured filter tree supporting AND/OR nesting. Two node types: leaf: {"type":"leaf", "field":"...", "op":"...", "value":...} group: {"type":"group", "operator":"and"|"or", "conditions":[...]} Available fields: custom_var, host, hostgroup, service Operators: eq, gte, in, lte, neq, regex Examples: # Objects in HG_AGILE: {"type":"leaf","field":"hostgroup","op":"eq","value":"HG_AGILE"} # In HG_AGILE OR with KERNEL=windows: {"type":"group","operator":"or","conditions":[ {"type":"leaf","field":"hostgroup","op":"eq","value":"HG_AGILE"}, {"type":"leaf","field":"custom_var","op":"eq","value":{"var":"KERNEL","val":"windows"}} ]} | |
| backends | No | Comma-separated backend names (sites). Omit for all backends. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Without annotations, the description bears full burden for behavioral disclosure. It mentions 'replayed from /logs' indicating historical data, but does not state whether the tool is read-only or any side effects. This is insufficient for a mutation-free tool with no annotation safety hints.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise at one sentence, front-loaded with key details, and every word is necessary. No wasted space.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with 4 parameters and no output schema, the description gives minimal context about what 'what changed' entails (e.g., state changes, performance?). It is adequate but not comprehensive; missing details about output format or specific change types.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so baseline is 3. The description does not add new information about parameters; it only briefly mentions t1 and t2 in context. No additional semantics are provided beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'List' and the resource 'what changed between two past instants', and specifies the data source ('/logs'). It effectively distinguishes this tool from siblings like thruk_state_at by focusing on differences over time. However, it does not explicitly name alternatives.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives or when not to use it. The description implies it's for historical comparison but lacks explicit context or exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
thruk_statsC
Aggregated host/service statistics.
| Name | Required | Description | Default |
|---|---|---|---|
| filter | No | Structured filter tree supporting AND/OR nesting. Two node types: leaf: {"type":"leaf", "field":"...", "op":"...", "value":...} group: {"type":"group", "operator":"and"|"or", "conditions":[...]} Available fields: custom_var, hostgroup Operators: eq, gte, in, lte, neq, regex Examples: # Objects in HG_AGILE: {"type":"leaf","field":"hostgroup","op":"eq","value":"HG_AGILE"} # In HG_AGILE OR with KERNEL=windows: {"type":"group","operator":"or","conditions":[ {"type":"leaf","field":"hostgroup","op":"eq","value":"HG_AGILE"}, {"type":"leaf","field":"custom_var","op":"eq","value":{"var":"KERNEL","val":"windows"}} ]} | |
| backends | No | Comma-separated backend names (sites). Omit for all backends. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations exist, so the description must disclose behavioral traits. It does not state whether the tool is read-only, whether it triggers any side effects, or any latency/rate-limit considerations. The term 'statistics' implies aggregation but no specifics.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is only 4 words, which is under-specification rather than efficient conciseness. It lacks structure and does not front-load key information; every sentence should earn its place, but here there is not even a full sentence.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the complexity of the filter parameter (nested JSON with group/leaf nodes) and the lack of output schema, the description is severely incomplete. It does not explain what 'statistics' include (e.g., counts, percentages, time ranges) or how results are structured.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Input schema has 100% coverage with descriptions for both parameters ('filter' and 'backends'). The description adds no additional meaning beyond the schema, which already explains filter structure and backends. Baseline score of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description 'Aggregated host/service statistics' is a phrase that loosely restates the tool name ('stats'). It lacks a verb and does not specify what the tool returns (e.g., counts, averages, distributions). Compared to siblings like thruk_totals or thruk_host_availability, it fails to distinguish itself.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives like thruk_totals or thruk_problem_counts. No mention of prerequisites, limitations, or excluded scenarios.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
thruk_top_noisy_hostsA
Return the top N hosts ranked by HOST ALERT count over a time window.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | ||
| since | No | Start of analysis window. Thruk relative time ("-2h", "-7d") or ISO datetime ("2026-05-21 14:00:00"). Default: last 24 h. | -24h |
| until | No | End of the time window (same formats as since). Default: now. | |
| filter | No | Structured filter tree supporting AND/OR nesting. Two node types: leaf: {"type":"leaf", "field":"...", "op":"...", "value":...} group: {"type":"group", "operator":"and"|"or", "conditions":[...]} Available fields: custom_var, host, hostgroup Operators: eq, gte, in, lte, neq, regex Examples: # Objects in HG_AGILE: {"type":"leaf","field":"hostgroup","op":"eq","value":"HG_AGILE"} # In HG_AGILE OR with KERNEL=windows: {"type":"group","operator":"or","conditions":[ {"type":"leaf","field":"hostgroup","op":"eq","value":"HG_AGILE"}, {"type":"leaf","field":"custom_var","op":"eq","value":{"var":"KERNEL","val":"windows"}} ]} | |
| backends | No | Comma-separated backend names (sites). Omit for all backends. | |
| group_by | No | Aggregation dimension: 'host' (default, one row per host) or 'hostgroup' (ventilation par client — counts fanned out across hostgroup membership). | host |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the burden. It mentions the time window parameter but lacks details on what constitutes an alert (hard/soft), sorting order, or performance implications. The behavior is somewhat transparent but incomplete.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence that is concise and front-loaded. Every word adds value, and there is no redundancy or unnecessary detail.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given 6 parameters, no output schema, and no annotations, the description is minimal. It does not describe the return format, filtering options, or grouping behavior. The schema covers some details, but the tool description lacks completeness.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 83%, so baseline is 3. The description does not add per-parameter meaning beyond the schema; it only provides the overall purpose. The schema itself has good parameter descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool returns the top N hosts ranked by HOST ALERT count over a time window. It uses specific verbs and resources ('Return', 'top N hosts') and distinguishes from siblings like thruk_top_noisy_services by focusing on hosts.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for retrieving top hosts by alert count but does not explicitly state when to use this tool versus alternatives like thruk_list_alerts or thruk_alert_heatmap. No exclusions or when-not guidance is provided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
thruk_top_noisy_servicesB
Return the top N services ranked by SERVICE ALERT count over a time window.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | ||
| since | No | Start of analysis window. Thruk relative time ("-2h", "-7d") or ISO datetime ("2026-05-21 14:00:00"). Default: last 24 h. | -24h |
| until | No | End of the time window (same formats as since). Default: now. | |
| filter | No | Structured filter tree supporting AND/OR nesting. Two node types: leaf: {"type":"leaf", "field":"...", "op":"...", "value":...} group: {"type":"group", "operator":"and"|"or", "conditions":[...]} Available fields: custom_var, host, hostgroup, service Operators: eq, gte, in, lte, neq, regex Examples: # Objects in HG_AGILE: {"type":"leaf","field":"hostgroup","op":"eq","value":"HG_AGILE"} # In HG_AGILE OR with KERNEL=windows: {"type":"group","operator":"or","conditions":[ {"type":"leaf","field":"hostgroup","op":"eq","value":"HG_AGILE"}, {"type":"leaf","field":"custom_var","op":"eq","value":{"var":"KERNEL","val":"windows"}} ]} | |
| backends | No | Comma-separated backend names (sites). Omit for all backends. | |
| group_by | No | Aggregation dimension: 'service' (default, one row per host+service), 'host' (rolled up per host), 'hostgroup' or 'servicegroup' (ventilation par client). | service |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden. It discloses the core behavior (returns top services by alert count over time) but omits details like whether it is read-only, permissions required, or how alerts are counted. No contradiction exists.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single, concise sentence that is front-loaded with the key action and result. No unnecessary words or repetition.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has 6 parameters and no output schema, the description is too sparse. It does not explain the meaning of 'alert count', the format of results, or how filtering works. The schema provides detailed parameter descriptions, but the tool's overall purpose and output are under-specified.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 83% (high), so the description adds little beyond the schema. It hints at the 'limit', 'since', 'until' parameters but does not elaborate on their semantics or provide examples beyond what the schema already offers.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it returns the top N services ranked by SERVICE ALERT count over a time window. It uses a specific verb ('return') and resource ('top N services'), and explicitly mentions ranking and time window, distinguishing it from sibling tools like thruk_top_noisy_hosts.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives, such as thruk_list_alerts or thruk_top_noisy_hosts. Lacks context about prerequisites or typical use cases, leaving the agent to infer based solely on the tool name and sibling list.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
thruk_totalsA
Compact host+service totals — 16 fields versus ~100 from thruk_stats.
| Name | Required | Description | Default |
|---|---|---|---|
| filter | No | Structured filter tree supporting AND/OR nesting. Two node types: leaf: {"type":"leaf", "field":"...", "op":"...", "value":...} group: {"type":"group", "operator":"and"|"or", "conditions":[...]} Available fields: custom_var, hostgroup, servicegroup Operators: eq, gte, in, lte, neq, regex Examples: # Objects in HG_AGILE: {"type":"leaf","field":"hostgroup","op":"eq","value":"HG_AGILE"} # In HG_AGILE OR with KERNEL=windows: {"type":"group","operator":"or","conditions":[ {"type":"leaf","field":"hostgroup","op":"eq","value":"HG_AGILE"}, {"type":"leaf","field":"custom_var","op":"eq","value":{"var":"KERNEL","val":"windows"}} ]} | |
| backends | No | Comma-separated backend names (sites). Omit for all backends. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the burden. It mentions the result size (16 fields) and compares verbosity, but does not disclose read-only nature, security requirements, or any side effects. Safe read behavior is implied but not stated.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence that is front-loaded with purpose and includes a meaningful comparison. No extraneous words, perfectly concise.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the complex filter schema and no output schema, the description is too minimal. It does not explain what 'totals' include (e.g., counts of states, problems), leaving the agent to guess the return structure. More detail is needed.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, with both parameters (filter and backends) well-described in the schema. The description adds no additional insight into parameters, so baseline score of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'Compact host+service totals' and explicitly distinguishes from thruk_stats by noting '16 fields versus ~100', making the tool's specific purpose and differentiation obvious.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear context by contrasting with thruk_stats, implying use for compact totals over detailed stats. However, it does not explicitly state when not to use or mention alternatives beyond thruk_stats.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
thruk_unacked_criticalA
CRITICAL services and DOWN hosts not acknowledged for more than N minutes.
| Name | Required | Description | Default |
|---|---|---|---|
| filter | No | Structured filter tree supporting AND/OR nesting. Two node types: leaf: {"type":"leaf", "field":"...", "op":"...", "value":...} group: {"type":"group", "operator":"and"|"or", "conditions":[...]} Available fields: custom_var, hostgroup Operators: eq, gte, in, lte, neq, regex Examples: # Objects in HG_AGILE: {"type":"leaf","field":"hostgroup","op":"eq","value":"HG_AGILE"} # In HG_AGILE OR with KERNEL=windows: {"type":"group","operator":"or","conditions":[ {"type":"leaf","field":"hostgroup","op":"eq","value":"HG_AGILE"}, {"type":"leaf","field":"custom_var","op":"eq","value":{"var":"KERNEL","val":"windows"}} ]} | |
| backends | No | Comma-separated backend names (sites). Omit for all backends. | |
| threshold_minutes | No | Minimum unacknowledged duration in minutes (default 60). |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided. The description indicates it's a read operation (non-destructive) and mentions the time threshold, but lacks details on return format, permissions, or pagination. Adequate for a simple list tool but could be more transparent.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence, 13 words, no fluff. All essential info is front-loaded. Every word serves a purpose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No output schema, so the agent doesn't know the return format. Despite clear purpose and well-documented parameters, the lack of output details leaves some uncertainty. Adequate for a simple tool but could be more complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with detailed descriptions for all parameters. The tool description adds context about the threshold (N minutes) but not much else. Baseline 3 is appropriate as the schema carries the information.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool retrieves CRITICAL services and DOWN hosts that are not acknowledged for a specified duration. It uses a specific verb (implied 'list') and resource ('unacknowledged critical items'), which distinguishes it from siblings like thruk_problems or thruk_stale_acks.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage: when you need unacknowledged critical issues older than N minutes. While not explicitly stating alternatives, it gives clear context for when to use this tool over others. A brief mention of exclusions would elevate it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
thruk_unreachable_vs_downB
Split a host outage window into DOWN (cause) vs UNREACHABLE (consequence).
| Name | Required | Description | Default |
|---|---|---|---|
| since | No | Start of analysis window. Thruk relative time ("-2h", "-7d") or ISO datetime ("2026-05-20 14:00:00"). Default: last 1 hour. | -1h |
| until | No | End of the time window (same formats as since). Default: now. | |
| filter | No | Structured filter tree supporting AND/OR nesting. Two node types: leaf: {"type":"leaf", "field":"...", "op":"...", "value":...} group: {"type":"group", "operator":"and"|"or", "conditions":[...]} Available fields: custom_var, host, hostgroup Operators: eq, gte, in, lte, neq, regex Examples: # Objects in HG_AGILE: {"type":"leaf","field":"hostgroup","op":"eq","value":"HG_AGILE"} # In HG_AGILE OR with KERNEL=windows: {"type":"group","operator":"or","conditions":[ {"type":"leaf","field":"hostgroup","op":"eq","value":"HG_AGILE"}, {"type":"leaf","field":"custom_var","op":"eq","value":{"var":"KERNEL","val":"windows"}} ]} | |
| backends | No | Comma-separated backend names (sites). Omit for all backends. | |
| sample_limit | No | Maximum hosts listed in each returned host array (default 100). |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must fully disclose behavioral traits. It fails to state whether the operation is read-only, destructive, or requires authentication, and does not mention rate limits or side effects.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, focused sentence that conveys the core idea without waste. It could benefit from a slightly expanded structure to include parameter hints, but remains efficient.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description omits what the tool returns (likely lists of DOWN and UNREACHABLE hosts). Given no output schema and 5 parameters, the lack of return-value context makes it incomplete for an agent to fully understand the result.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 100% schema description coverage, the schema already documents all parameters. The tool description adds no parameter-level detail beyond the schema, so baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses specific verbs ('Split') and a clear resource-context ('host outage window') to define its unique purpose. It clearly distinguishes from siblings like 'thruk_host_availability' by focusing on cause-vs-consequence analysis.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies when to use (for analyzing host outages), but offers no explicit guidance on when not to use or alternative tools. Siblings like 'thruk_host_availability' or 'thruk_incident_timeline' exist, but no contrast is given.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
thruk_worker_healthC
Distinguish a real outage from a mod-gearman supervision blind spot.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Maximum rows scanned per object type (max 5000, default 500). | |
| backends | No | Comma-separated backend names (sites). Omit for all backends. | |
| sample_limit | No | Maximum example rows returned in 'samples' (default 20). | |
| include_hosts | No | Also scan /hosts host checks for worker artefacts (default true). | |
| include_services | No | Scan /services for worker artefacts (default true). |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description must disclose behavioral traits. It only states 'distinguish,' giving no indication of side effects, permissions, rate limits, or whether the tool is read-only. Key behaviors such as data scanning limits (inferred from parameters) are not mentioned in the description.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise (one sentence, no filler). It lacks structured formatting (e.g., bullet points), but for such brevity, the lack of structure is acceptable. Every word serves a purpose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with no output schema and moderate complexity (5 parameters), the description is insufficient. It fails to explain what the output contains, how to interpret results, or how the tool differentiates real outages from blind spots. Users are left without enough context to use it effectively.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the schema already documents all five parameters. The description adds no extra meaning beyond the schema, meeting the baseline of 3. However, it does not synthesize parameter behavior (e.g., that limit and sample_limit control scanning and output).
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: distinguishing a real outage from a mod-gearman supervision blind spot. This provides a specific verb ('distinguish') and resource ('mod-gearman supervision blind spot'), setting it apart from general health checks like thruk_backend_health. However, it lacks explicit mention of 'worker health' or 'Thruk workers', which could be more precise.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives like thruk_backend_health, thruk_concurrent_failures, or thruk_problems. The description implies a diagnostic scenario but does not specify context, prerequisites, or exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.
65 tool updates
v2.1.0- First observed
thruk_acknowledge - First observed
thruk_add_comment - First observed
thruk_alert_heatmap - First observed
thruk_backend_health - First observed
thruk_bulk_acknowledge - First observed
thruk_checks - First observed
thruk_concurrent_failures - First observed
thruk_delete_active_downtimes - First observed
thruk_delete_comment - First observed
thruk_delete_downtime - First observed
thruk_delete_downtimes_by_filter - First observed
thruk_flap_summary - First observed
thruk_get_contact - First observed
thruk_get_downtime - First observed
thruk_get_host - First observed
thruk_get_perfdata - First observed
thruk_get_service - First observed
thruk_host_availability - First observed
thruk_hostgroup_availability - First observed
thruk_hostgroup_availability_summary - First observed
thruk_incident_timeline - First observed
thruk_list_alerts - First observed
thruk_list_comments - First observed
thruk_list_contacts - First observed
thruk_list_downtimes - First observed
thruk_list_hostgroups - First observed
thruk_list_hosts - First observed
thruk_list_logs - First observed
thruk_list_notifications - First observed
thruk_list_servicegroups - First observed
thruk_list_services - First observed
thruk_notification_heatmap - First observed
thruk_notification_summary - First observed
thruk_notifications - First observed
thruk_oldest_problems - First observed
thruk_perfdata_near_threshold - First observed
thruk_perfdata_snapshot - First observed
thruk_problem_counts - First observed
thruk_problems - First observed
thruk_query - First observed
thruk_recent_events - First observed
thruk_recheck - First observed
thruk_recurring_problems - First observed
thruk_reliability_report - First observed
thruk_remove_acknowledgement - First observed
thruk_root_cause - First observed
thruk_run_background_query - First observed
thruk_schedule_downtime - First observed
thruk_schedule_host_services_downtime - First observed
thruk_schedule_hostgroup_downtime - First observed
thruk_schedule_propagated_host_downtime - First observed
thruk_schedule_servicegroup_downtime - First observed
thruk_service_availability - First observed
thruk_sites - First observed
thruk_stale_acks - First observed
thruk_stale_checks - First observed
thruk_state_at - First observed
thruk_state_diff - First observed
thruk_stats - First observed
thruk_top_noisy_hosts - First observed
thruk_top_noisy_services - First observed
thruk_totals - First observed
thruk_unacked_critical - First observed
thruk_unreachable_vs_down - First observed
thruk_worker_health
TDQS
Most tools have distinct purposes, but similarities among problem- and alert-related tools (e.g., thruk_problems, thruk_oldest_problems, thruk_problem_counts, thruk_recurring_problems) may cause confusion if descriptions are not carefully read.
All tools start with 'thruk_' and follow a mostly verb_noun pattern (e.g., list_hosts, schedule_downtime). Some are just nouns (stats, totals), but deviations are minor.
With 65 tools, the set is excessively large for an agent to navigate efficiently. Many tools could be merged or parameterized to reduce cognitive load.
The tool set covers the main monitoring lifecycle (list, get, acknowledge, comment, downtime, availability, perfdata). The thruk_query escape hatch fills gaps, though some update/configuration operations are missing.
Maintenance
Resources
Unclaimed servers have limited discoverability.
Looking for Admin?
If you are the server author, to access and configure the admin panel.
Related MCP Connectors
- sentinelOAuthio.rootstuff
Uptime, SSL, DNS and domain monitoring you can talk to from Claude or any MCP client.
Personal assistant MCP server with search, execute, packages, jobs, secrets, and integrations.
Remote MCP server for managing Muninx tickets, messages, ticket search, and support analytics.
Related MCP Servers
- AlicenseAqualityAmaintenanceMCP server for Uptime Kuma that enables monitoring and management of uptime monitors, heartbeats, notifications, tags, and maintenance windows via natural language.3148048MIT
- AlicenseNot gradedqualityDmaintenanceEnables complete management of CheckMK monitoring environments through natural language, including live monitoring, downtime scheduling, problem management, and configuration.16GPL 3.0

Drumbeats MCPofficial
AlicenseAqualityAmaintenanceMCP server for Drumbeats monitoring. Enables creating monitors, triaging incidents, and running HTTP/SSL/DNS checks using natural language from any AI client.16202Apache 2.0- AlicenseAqualityDmaintenanceEnables managing UptimeRobot monitors, alert contacts, and maintenance windows via natural language through the MCP protocol.16MIT
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/k9fr4n/thruk-mcp'
If you have feedback or need assistance with the MCP directory API, please join our Discord server