Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and destructiveHint=false, and the description reinforces this with "defensive and read-only by design" while adding genuinely new behavior: live-scope requests are gated to a human before execution. That routing/gating detail is exactly the kind of context annotations cannot convey. It stops short of describing turnaround or how results are delivered.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Three short sentences, front-loaded with purpose, then safety posture, then the gating rule. Nothing is wasted, though the parenthetical category list is slightly compressed and could read as fragmentary.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a three-parameter request tool with no output schema and no annotations covering outcomes, the description omits what happens after submission — whether the scan is asynchronous, what identifier is returned, or how findings are retrieved. Given the human-gate behavior it describes, an agent would reasonably want to know the request's lifecycle, and that is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must carry parameter meaning, and it only partially does. It names the hunt categories (matching the scan_type enum) and alludes to the environment parameter via the live-scope gating sentence, but never explains the test/live distinction itself or what a good scope_description looks like. The enum values are already in the schema, so listing them adds limited value beyond the HNDL expansion.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb-plus-resource ("Request an autonomous threat-hunt scan") and enumerates the covered hunt categories, so the agent knows exactly what capability is being invoked. It doesn't explicitly contrast itself with the catalog/purchase/quote/attestation siblings, but the domain gap is obvious enough from the wording.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is implied rather than stated: the agent can infer this is the tool for initiating threat hunts, and the note about live-scope scans routing to a human gate gives a useful precondition. There is no explicit when-not guidance and no reference to an alternative tool for related tasks.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.