Find events matching text across the last hour - use when you know what the message says (an exception, an order id, a URL) but not which stream it is in.
| Name | Required | Description | Default |
|---|---|---|---|
| level | No | Optional minimum level | |
| limit | No | Max matches (default 50, cap 200) | |
| topic | No | Optional topic or prefix to narrow the search | |
| contains | Yes | Text to find (case-insensitive) |
Changes observed during successful MCP inspections.
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It discloses the time window ('across the last hour') and the search behavior, which is useful. However, it does not mention the return format, pagination, or any side effects. For a search tool this is a reasonable baseline, but the lack of richer context (e.g., results structure) prevents a higher score.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence that is front-loaded with the action and time constraint, then adds the use-case context. It is concise with no wasted words. Slightly less crisp than the best examples but still effective.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool has four params, all documented in the schema, and no output schema. The description explains the main use case and time scope but does not describe what the result looks like (e.g., list of matching events). For a search tool, this is a gap but not critical—agents can infer. Overall it is adequate but not fully complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, meaning all four parameters are documented in the schema. The description adds minimal extra meaning beyond the schema—it only paraphrases the 'contains' parameter and adds the time context. Per the baseline, 3 is appropriate since the schema already does the heavy lifting.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'Find events matching text' and specifies a resource (events/messages) and a time constraint ('across the last hour'). It also implies cross-stream search by noting 'but not which stream it is in', which distinguishes it from stream-specific tools like tail_logs. However, it does not explicitly name a sibling, so it falls short of a 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides explicit guidance on when to use: 'use when you know what the message says (an exception, an order id, a URL) but not which stream it is in.' This gives a clear condition for selection. Missing is an explicit 'do not use when' statement or alternatives, so it's not a 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Add one secure layer between your agents and this server.
