search_by_ipSearch scans by IP address (paginated).
| Name | Required | Description | Default |
|---|---|---|---|
| page | No | ||
| limit | No | ||
| ip_address | Yes |
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already provide safety hints (readOnly, idempotent, non-destructive), so the description's burden is low. However, the description adds no behavioral context beyond the annotations; 'paginated' is redundant with the page and limit parameters in the schema. No rate limits, auth requirements, or side effects are disclosed.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, concise sentence with no fluff. It front-loads the core purpose ('Search scans by IP address') and appends the pagination note. While terse, it is structurally efficient and does not waste words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a search tool with pagination and an output schema, the description is too minimal. It does not explain what 'scans' are, how IP matching works (exact, partial, subnet), or any search-specific behavior. The presence of an output schema excuses missing return-value details, but the description still lacks essential operational context.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description should compensate by explaining parameter meanings. It only mentions 'IP address' and 'paginated', leaving ip_address format (IPv4/IPv6, exact match) and page/limit semantics to be inferred from names. The description fails to add meaningful value over the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('Search'), the resource ('scans'), and the filter ('by IP address'), distinguishing it from other search_by_* sibling tools. The added 'paginated' note further specifies the behavior, making the purpose unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies when to use the tool (when searching scans by IP) but offers no explicit guidance about alternatives or exclusions. It does not mention when to use this tool over search_by_asn or other search variants, leaving usage context to be inferred.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Add one secure layer between your agents and this server.
Many tools overlap in purpose, particularly the JS fingerprint search functions (e.g., search_js_fingerprint_by_md5 and search_jsfingerprints_by_md5) which are nearly identical. The large number of get_* and search_* tools for various statistics also creates boundary ambiguity.
The verb_noun pattern is mostly followed, but there are significant inconsistencies: 'jsfingerprints' vs 'js_fingerprints' vs 'js_fingerprint', and the occasional use of 'find' instead of 'search' (e.g., find_js_fingerprint_similar_by_hash). This mixed style makes it hard to predict tool names.
With 128 tools, the server is severely over-scoped. Many tools could be combined (e.g., all search_jsfingerprints_by_* variants) or parameterized. The sheer number overwhelms an agent and suggests poor API design.
The core URL scanning workflow (submit, retrieve results, search, analyze) is well covered, including detailed sub-analyses like malware, YARA, and JS fingerprints. Minor gaps include no scan cancellation or user-specific scan listing, but overall coverage is strong.