Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure. It goes beyond the schema by mentioning that only DECRYPTED HTTPS flows are captured, that bodies are truncated, and that the snapshot is since ios_traffic_start. These are meaningful operational traits. It does not explicitly mention that the capture must be active, but this is strongly implied by the phrasing and the companion start tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Three sentences, tightly packed with relevant information. The first sentence states the core purpose and return fields. The second explains the optional body inclusion. The third covers filtering and limit. No filler or redundant phrasing; every sentence earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given that there is no output schema, the description does well to list the returned fields and optional body payload. It covers the main options and their effects. The primary gap is not explicitly stating that a capture must be in progress (started via ios_traffic_start), but the phrase 'since ios_traffic_start' covers this context for an informed agent. Overall, it is sufficient for a tool with this level of complexity.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3. The description adds value by explaining what includeBodies returns (headers + truncated bodies), how urlSubstring and onlyErrors filter flows, and what fields each flow contains (method, url, host, status, etc.). It connects the 'limit' parameter to the 'most recent' behavior, reinforcing rather than duplicating the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific action ('Snapshot recent DECRYPTED HTTPS flows') with a clear resource and scoping. It lists the fields returned, distinguishing it from starting/stopping traffic capture (ios_traffic_start/stop) and from Android equivalents. The verb 'snapshot' and the explicit 'since ios_traffic_start' establish a unique purpose without ambiguity.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies when to use the tool: after ios_traffic_start has been called. It gives practical guidance on how to use includeBodies, urlSubstring, onlyErrors, and limit. It stops short of explicitly naming alternatives or excluding cases (e.g., 'use android_traffic_flows for Android'), but the sibling context and platform prefix make the usage clear.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.