Example Prompts

Example Prompts

Questions an administrator actually asks, and the tools that answer them. The agent picks tools on its own from their descriptions; these are here so you know what the toolset can and cannot reach, and so you can steer it when it picks badly.

Serial numbers below are placeholders — substitute your own.

Fleet health

Give me a fleet summary: how many devices, how many are healthy.

fleet_summary — one call, the same rollup the dashboard's landing page shows.

Anything gone wrong in the last hour?

recent_events with a small limit. Events come back newest first, with no time filter, so ask for 25 or 50 rather than the whole log.

Is ReportMate itself healthy, or is the API having trouble?

api_health. It probes the database as well as the API process, so a failure here distinguishes "the API is down" from "the fleet has no data".

Finding devices

How many devices are in the fleet?

search_devices with no query.

Find the device with serial WS-0001.

search_devices with the serial as the query, or get_device directly if you want the full record.

Which devices are running Windows 11?

search_devices with a query like Windows 11. Be aware the filter is a plain substring match over the whole serialized device record, so it is generous — it will match anywhere in the record, not just the OS field. Treat the result as a candidate list, not a precise answer.

Show me 10 devices so I can see what fields are available.

search_devices with limit=10. Worth doing first on a large fleet, before asking for anything unbounded.

One device in depth

Tell me everything about WS-0001.

get_device. This returns all modules for that device and can be a large payload; prefer the module form when you know what you are after.

What managed installs are pending or failing on WS-0001?

get_device_module with module="installs".

What is the disk and memory situation on WS-0001?

get_device_module with module="hardware".

Is WS-0001 encrypted, and what is its security posture?

get_device_module with module="security".

What network interfaces does WS-0001 have and what is its IP?

get_device_module with module="network".

Fleet-wide by module

Each of these is module_report with a different module name. Every one returns data for every device, so they are the heaviest tools in the set — ask a narrow question so the agent summarizes rather than dumps.

Question	Module
Which devices have install errors right now?	installs
What OS versions and builds are deployed across the fleet?	system
How many devices are MDM-enrolled, and by which management platform?	management
What hardware models are we running, and how old are they?	hardware
Which devices are short on disk space?	hardware
What is the asset and location data for the fleet?	inventory
Which devices have encryption disabled?	security
Who is signed in across the fleet?	identity
What monitors and other peripherals are attached?	peripherals
What software is installed across the fleet?	applications
What are the fleet's IP addresses and network configuration?	network

Software

Which applications are actually being used, and which are shelfware?

application_usage — the fleet-wide utilization report. Use this rather than module_report("applications") when the question is about usage rather than mere presence.

If the answer will inform a licence decision, tell the agent to quote activeHours and activeUserCount, not totalHours and userCount. The latter pair includes background process time, so a daemon looks like the busiest software you own. Tools Reference has the full distinction.

Is Acme Widget Pro installed anywhere, and is anyone launching it?

Two calls: module_report("applications") for presence, application_usage for whether it is being run. The agent has to correlate them; there is no single tool for this.

Multi-step questions

The tools compose, so an agent can chain them. These take several calls and are worth asking explicitly:

Look at recent events, find any device reporting install errors, then pull that device's installs module and tell me which package is failing.

recent_events → search_devices or get_device → get_device_module.

Compare the security posture of WS-0001 against the fleet — is it an outlier?

get_device_module for the one device, module_report("security") for the baseline.

What it cannot do

• Nothing is mutable. No archiving, deleting, remediating, or triggering a check-in. The server registers only read tools and its HTTP client has no write methods.
• No server-side search. search_devices fetches the whole list and filters locally, so it cannot express structured queries such as "last seen before a date". Ask the agent to reason over the returned data instead.
• No history or diffs. The tools return current state. "What changed on WS-0001 last week?" can only be answered as far as the events feed and the device's own records carry that history.
• One fleet. Credentials are per-process, so a single server instance sees exactly one ReportMate deployment.