Tool Reference Overview
InfraScout exposes 207 MCP tools across fifteen functional areas. You normally do not call these tools by name — you describe what you want and InfraScout selects the right tool. The pages in this section are reference material for when you want to know exactly what is available, what each tool returns, and how it composes with the others.
How to Read These Pages
Every tool entry leads with a short description of what the tool does. Where it matters, a Parameters table documents non-trivial inputs (filters, paging, projections), with required parameters marked. Example prompt shows the natural-language phrasing that typically routes the AI to this tool. Where the response shape is non-obvious — composite payloads, faceted aggregations, or envelopes that signal pagination — a brief sample illustrates the structure.
Trivial single-ID lookups skip the parameter table; the prose names the input field directly. The authoritative schema is what the MCP server returns over the wire — your AI client reads that automatically. These pages exist for humans designing workflows, auditing capability surface, or building integrations.
Argument names are validated strictly on every tool: an unknown or misspelled argument returns an explicit error naming the offending field instead of being silently ignored. A mistyped filter parameter therefore fails loud — it can no longer silently run an unfiltered query.
Where two tools work together (such as a list_* plus a get_* pair), the description calls out the companion tool so you can chain them efficiently.
Tool Categories
InfraScout's tools fall into fifteen groups. The first eight operate on InfraScout itself — agents you have deployed, sessions, insights, inventory, playbooks, data collection sets, chart display, and authentication. The last seven operate on your connected Microsoft cloud tenant and require an Entra connection.
Authentication & Connections
Verify the caller identity and discover which Entra tenants are connected. Two tools.
Read reference →Agents
Enumerate, group, and command the agents installed on your hosts. Twenty-four tools covering listing, grouping, host summaries, remote execution over shell, PowerShell, WMI, LDAP, Windows Event Log, and long-lived daemon starts, plus cross-platform log file reading, the systemd journal, Linux performance metrics, Windows performance counters, and live ETW tracing.
Read reference →Sessions
Open, inspect, and submit assessment sessions that scope every command and finding to a clear boundary, plus the session groups that bundle them per conversation. Seven tools.
Read reference →Insights
Save, retrieve, list, aggregate, update, and delete the structured findings produced during a session. Six tools.
Read reference →Inventory
Query collected snapshots of host facts, software, services, and certificates across the fleet. Ten tools.
Read reference →Playbooks
Discover and retrieve the structured assessment playbooks that guide InfraScout through standardized reviews. Three tools.
Read reference →Data Collection Sets
Curated, ready-to-run Windows ETW capture profiles for common investigations — live captures you reproduce on demand and boot captures that record across a reboot. Four tools.
Read reference →Chart Display
Render an interactive line, area, bar, donut, pie, heatmap, or treemap chart inline in the chat from data the AI already gathered. One tool.
Read reference →Microsoft Cloud — Identity
Audit users, groups, service principals, directory roles, administrative units, and PIM eligibility in your Entra tenant. Twenty-four tools.
Read reference →Microsoft Cloud — Platform
Inspect Azure subscriptions, resources, costs, app registrations, GDAP relationships, and entitlement governance. Twenty tools.
Read reference →Microsoft Cloud — Security
Review Defender alerts and incidents, Conditional Access, sign-ins with server-side aggregation, the Microsoft 365 Unified Audit Log, analyzed emails, attack simulation training, Defender for Identity sensor posture, Defender for Endpoint, Vulnerability Management, Security Exposure Management attack paths, Advanced Hunting (KQL), BitLocker keys, LAPS credentials, risky users, and Secure Score. Fifty-two tools.
Read reference →Microsoft Cloud — Services
Query Microsoft 365 surfaces — Teams, SharePoint, OneDrive, sharing links, Exchange Online, message trace, licensing, and usage reports. Twenty-two tools.
Read reference →Microsoft Cloud — Intune
Assess Intune device management — managed devices and their per-device configuration, compliance, Defender protection, and detected malware, plus a per-user device lookup, tenant-wide compliance rollups, configuration profiles, the Settings Catalog, Administrative Templates, security baselines, and apps. Twenty-one tools.
Read reference →Microsoft Cloud — Service Health
Check Microsoft 365 service status, track health incidents and advisories, and read message center announcements. Six tools.
Read reference →Microsoft Cloud — Cloud App Discovery
Surface shadow IT from Defender for Cloud Apps — discovered apps with risk scores and traffic, plus the users, devices, and IPs behind them. Five tools.
Read reference →What's Available by Default
Not every category here needs to be turned on. Sessions, Insights, and the Agents and Inventory tool sets are core — every conversation has them from the first turn, regardless of role, model, or any tool selection you make, and an administrator cannot hide them. So if your AI client can already reach your fleet and read inventory without you asking for it, that is expected: remote execution and inventory tools ship on by default. The Microsoft Cloud categories are selectable — InfraScout chooses which ones a given conversation needs, and a tenant administrator can scope or hide them per tool group.
Two Conventions Worth Knowing
Most tool calls flow through one of two helpers, and they show up across every category page.
session_id
Every command that executes on a host runs inside a session. You start one with session_start, then pass the returned session_id to agent_exec_* and to insight_save. The target agent is derived from the session — you never repeat the agent_id once a session is open. Sessions exist so every command, output, and finding has a clear audit boundary; you submit the session for review with session_submit when you are done.
connection_id
Every mscloud_* tool accepts an optional connection_id. Omit it and InfraScout uses the default Entra connection. Pass one when you operate across multiple tenants — for example, an MSP managing several customer tenants through GDAP. Use entra_connection_list to discover which connections are configured.
Permissions
Your role determines which tools you can invoke. InfraScout defines five roles — Users, MCPUser, Operator, MCPOperator, and Admin — described in Connecting Your AI Client. Reaching this tool set at all requires one of the three MCP-client roles (MCPUser, MCPOperator, or Admin); the reference pages do not repeat role requirements per tool, so if a call returns an authorization error, your role is the most likely cause.
See Also
The conceptual model behind agents, sessions, insights, and playbooks is described in Key Concepts. For prerequisites and end-to-end walkthroughs, see Quick Start and Running Assessments.