Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint, openWorldHint, and idempotentHint, reducing the burden on the description. The description adds behavioral context by noting 'Pass async:true to avoid timeout,' indicating potential slow execution and providing a mitigation strategy. It does not cover rate limits or auth, but the async hint adds value beyond annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is four sentences, each earning its place: purpose, inputs, outputs, and async note. It is front-loaded with the primary function and avoids fluff. Slightly verbose with 'As a CTO' framing, but still concise overall.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool has an output schema, the description does not need to detail return values. It covers inputs, use cases, and the async fallback, which is sufficient for a moderately complex tool with 6 params. It lacks explicit prerequisites or edge cases, but the presence of an output schema and annotations fills gaps, making it fairly complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 83%, so the schema already describes most parameters. The description adds semantic meaning by giving examples: 'threat actor groups, MITRE tactics (e.g., 'TA0005'), or log sources (e.g., 'AWS CloudTrail')' and explains that outputs include 'MITRE mappings, prevalence scores, and detection recommendations,' which connects the parameters to the tool's purpose. This enhances the schema's dry parameter names.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: 'extract anomalous log patterns from public breach reports ... and MITRE ATT&CK techniques to optimize SIEM rules and observability pipelines.' This uses a specific verb ('extract') and resource (log patterns, breach reports, MITRE techniques), distinguishing it from sibling tools like observability_metric_anomaly_detector, which focuses on metric anomalies rather than log pattern mining.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides clear context on when to use the tool: 'Ideal for reducing false positives and improving breach detection coverage.' It also explains inputs and outputs, giving a sense of use cases. However, it does not explicitly mention alternatives or when not to use it, so it lacks explicit exclusions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.