Loading ToolBench
MCP server for Microsoft Defender Advanced Hunting - execute KQL queries via natural language
Two tools with clear action verbs and reasonable descriptions (194 - 250 chars, within baseline 34 - 392). Both have documented input schemas with type and description. However, output schemas are completely undocumented, LLMs cannot predict what fields to expect from results. Error handling is generic (catch-all exceptions returning plain text). No parameter constraints (enums, ranges), no guidance on when to call each tool relative to the other, and no structured output format. Naming is good (get_*, run_*), but composition guidance is weak.
Get the Advanced Hunting schema with available tables and columns. Call this before writing queries to understand what data is available. Returns table names, column names, and data types.
Execute a KQL (Kusto Query Language) query against Microsoft Defender Advanced Hunting. Use this to investigate security events across endpoints, email, identity, and cloud apps. Always call get_hunting_schema first to understand available tables and columns.
Output schemas completely undocumented. Both tools return plain-text markdown tables with no structured field definitions. LLMs cannot parse results reliably or chain to downstream tools.
No input parameter constraints. 'query' and 'table_name' accept free-form strings with no enum, regex, or format guidance. LLMs may pass invalid KQL syntax or non-existent table names without validation hints.
Generic error handling. Exceptions caught as plain text ('Query error: ...', 'Schema error: ...'). No guidance on recovery (e.g., 'Invalid table name. Call get_hunting_schema to list available tables'). LLMs cannot self-correct.
No composition guidance. Description says 'Always call get_hunting_schema first' but does not explain why or when. LLMs may skip the discovery step or call tools in wrong order.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | C | 60 | 2026-07-28+ | v2 |
Markdown table output is unstructured. Parsing row/column data from markdown requires LLM text processing, which is error-prone and wastes tokens. Return JSON with typed fields instead.