Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are present, so the description carries the full burden of behavioral disclosure. It only lists vague data categories and never explains what the tool does, what input it expects, what side effects exist, or what the response looks like.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The text is short, but it is under-specification rather than useful concision. It repeats the title and adds almost no functional information that an agent can act on.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Even for a single-optional-parameter tool, the missing semantics for q are a serious gap. The output schema may cover return values, but without input meaning or a usage context, the tool is not complete enough to invoke confidently.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% and the only parameter q is undocumented. The description does not mention q or clarify whether it expects a threat actor name, alias, group identifier, or free-text query.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description is a noun phrase that mostly restates the title ('Threat Actor: Known campaigns, techniques, tools') and contains no verb such as search, lookup, or list. It names content areas but does not say what operation the tool performs or how it differs from similar siblings like threatcrowd, apt_track, or threat_pattern.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

No usage guidance is provided. The description does not say when to use this tool versus alternatives, and with many overlapping threat-intel siblings present, an agent has no basis for selection.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.