Ivanti Tools Server for MCP - provides database access, Ivanti ITSM API integration, and RAG-based knowledge base querying
Server has 9 tools with basic schemas and descriptions, but significant quality gaps. Descriptions are present but often generic or in Chinese without English translations for LLM clarity. Parameter descriptions are minimal. No output schemas documented. Error handling is absent, tools fail silently or return raw exceptions. Tool names lack consistent verb-noun patterns. No pagination support despite database queries. Security concerns: credentials in environment variables (good), but no input validation against SQL injection despite accepting raw SQL queries. Composition is weak, tools are loosely related (database + Ivanti API + RAG) without clear chaining support.
可以创建一个索引,参数名为document_path和persist_path。
可以将表格的所有column值都解析出来。请注意:该表格所需参数名为'table'。
可以根据工单单号获取Ivanti工单的详细信息。请确保已登录后再调用此工具,参数名为ticket_number。
可以根据用户登录ID获取Ivanti用户的详细信息。请确保已登录后再调用此工具,参数名为login_id。
加载以持久化的索引,并创建流式RAG搜索引擎。参数名为persist_path。
可以将数据库中所有的表格都列举出来,并且能获取所有表格的大致信息。
可以登录Ivanti系统并获取Session Key。成功登录后会缓存Session Key供后续接口使用。参数需要提供tenant、username、password、role。
Descriptions are in Chinese and lack English clarity for LLM selection. E.g., 'query_mysql' description does not explain when to use it vs. 'list_tables' or 'describe_table', or what the output structure is. LLMs cannot reliably select the right tool without clear English descriptions.
No output schemas documented. Tools return raw database rows, API responses, or RAG results without specifying field names, types, or structure. LLMs cannot plan downstream calls or extract data reliably.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | C | 64 | 2026-07-28+ | v2 |
可以执行一个安全的SELECT query以确保能够从数据库中调取合理的数据。请注意:该表可所需参数名为'query'。
执行RAG查询。参数为query_str(用户问题)
SQL injection risk: 'query_mysql' accepts raw SQL strings and validates only with a regex. Regex can be bypassed. No parameterized queries or prepared statements visible. 'describe_table' and 'list_tables' use f-strings with table names, vulnerable to injection.
No error handling or recovery guidance. Tools fail with raw exceptions or generic errors. E.g., if 'login_ivanti' fails, no guidance on retry or alternative actions. If 'query_mysql' times out, no timeout error message.
No pagination support for 'list_tables' or 'query_mysql'. Large result sets will blow context windows. No limit parameter, no offset/cursor, no total count returned.