Loading ToolBench
Model Context Protocol server for Cisco Secure Network Analytics (Stealthwatch)
Server defines 5 tools with consistent naming (verb_noun pattern: sna_list_*, sna_get_*) and basic descriptions. All tools have input schemas with type definitions and parameter descriptions. However, descriptions are terse (10-60 chars), lack context on WHEN to use each tool, and omit error recovery guidance. Output schemas are undocumented, LLMs cannot predict response structure. No enum constraints on severity parameter. Error handling returns raw error strings without actionable recovery steps.
Get host details (host groups, traffic profile, recent alarms) for an IP.
List alarms for a tenant. `severity` is one of CRITICAL, MAJOR, MINOR, INFO.
List recent security events / detections for a tenant.
Run a flow query against SNA.
List tenants (domains) configured on the SMC.
Output schemas undocumented. Tools return JSON strings but LLMs cannot predict field names, types, or structure. Agents cannot plan downstream calls or extract specific data reliably.
Descriptions too brief (10-60 chars). Lack context on WHEN to use each tool, prerequisites, or how results differ from similar tools. sna_list_alarms and sna_list_flows are easily confused.
severity parameter in sna_list_alarms accepts free-form string. Should be enum: [CRITICAL, MAJOR, MINOR, INFO]. Current design invites hallucinated values.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | C | 60 | 2026-07-28+ | v2 |
Error handling returns raw SNAError strings ('ERROR: {e}'). Does not guide LLM on recovery: is error retryable? Should user check credentials? Are there alternative tools?
No pagination guidance in tool descriptions. sna_list_flows and sna_list_alarms accept limit but do not document max results, whether results are truncated, or how to fetch next page.