Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already cover read-only/idempotent safety, but the description adds substantial behavioral details: rate limits (30/hr free, 500/hr Pro, token cost), a breaking change in enrichment.vulns format (list[VulnInfo] vs list[str]), the asn block's 50-prefix cap, and the top-level return keys. This goes far beyond the annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is long but every sentence carries essential operational info: core purpose, usage context, two critical caveats (asn prefix cap, vulns breaking change), rate limits, and return structure. It is front-loaded with the primary purpose and structured logically, with no wasted words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (multiple data sources, nested structures, version sensitivity, rate limits) and the presence of an output schema, the description covers all key operational aspects: limitations, version change, rate limit, and the shape of the return object. It is fully sufficient for an agent to select and invoke the tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The only parameter 'ip' is fully documented in the schema (data type, examples, rejection of private/reserved IPs). The description does not add any extra semantics for the parameter itself; it only reuses the concept of IP in the context of the tool. With 100% schema coverage, this is a baseline adequate score.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb ('Query') and resource ('comprehensive threat profile for an IP'), enumerating the data sources (Shodan, AbuseIPDB, ASN/geolocation, open ports). It clearly distinguishes from siblings by explicitly pointing to domain_report for domain data.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

It states when to use ('Use for IP investigation and SOC alert triage') and provides an explicit alternative: 'for domain data use domain_report.' It also cross-references asn_lookup for full prefix lists, giving clear guidance on related tools.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.