Dual-Context Incident Investigation — fans a developer question to Splunk MCP Server (operational reality) and SigMap MCP Server (code structure) in parallel, synthesizes both with a Splunk hosted model, and scores groundedness
DualContext exposes 2 tools with basic descriptions but critical gaps in schema completeness and parameter documentation. run_splunk_query has a partial input schema (query, earliest) but lacks output schema documentation. query_context similarly lacks output schema. Neither tool has parameter descriptions beyond the bare names. Descriptions are present but generic (194-char baseline for A+ tools; these are ~80-100 chars). No error handling guidance, no idempotency hints, no permission declarations. Tools are read-only (good) but lack the structured output and chaining metadata needed for reliable agent composition. Schema visibility is limited to input parameters only, output structures are not documented in the source.
Ask SigMap to rank the most relevant files for a query, returning ranked files with signatures and token accounting
Run a Splunk SPL query and return results as rows
Output schemas not documented. Neither tool specifies what fields are returned, their types, or structure. LLMs cannot plan downstream calls or extract chaining IDs (e.g., file_id, query_id) without documented output.
Parameter descriptions missing or trivial. 'query' and 'earliest' in run_splunk_query lack descriptions explaining format, constraints, or examples. 'topK' in query_context lacks description of valid range (1 - 100?) or default behavior.
No error handling guidance. Tools do not document what errors are retryable, what user-fixable errors look like, or how to recover. E.g., 'Query syntax error' vs 'Splunk service unavailable' require different agent responses.
Inferred effective spec: <=2025-11-25.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | F | 49 | <=2025-11-25 | v2 |
No idempotency or confirmation hints. run_splunk_query is read-only (safe), but query_context's ranking behavior is not documented as deterministic or idempotent. Agents retrying on ambiguous failures need this clarity.
Tool names lack action verbs. 'run_splunk_query' is acceptable (verb: run), but 'query_context' is ambiguous, does it query, search, rank, or retrieve context? Rename to 'search_code_context' or 'rank_files_by_relevance' for clarity.