Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With readOnlyHint already covering safety, the description adds substantial behavior the annotation cannot: default limit 500 newest-first, local regex filtering that suppresses the CloudWatch-side filter when contextLines is set, a literal-substring fallback for invalid regex, query truncation caps, and a paginationWarning field. That is real operational context, not restatement.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Purpose and the failure-diagnosis guidance are front-loaded, which is correct, but the response-field inventory is listed twice in slightly different forms (perQuery match counts/scannedLines first, then totalLines/returnedLines/matchCount), and the multi-query best-practice paragraph runs long. Some sentences duplicate rather than add.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

There is no output schema, so the description carries return-value duty and does so thoroughly, including paginationWarning and truncatedQueryCount. Minor gaps remain: sort direction is only implied, and the duplicated/partly inconsistent response field lists could confuse an agent about what keys actually come back.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%, so the description must carry the load and it mostly does: query vs queries, contextLines range and grep-style behavior, diagnosticPreset enum values enumerated with what each searches, nextToken pagination, limit default, and the time-range params. `sort` is never explained and `suppressNoise` is only hinted at via the phrase "noise suppression".

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

Opens with a specific verb+resource+scope: "Returns CloudWatch logs from a live deployment's container." The "live deployment" scoping distinguishes it from get_backtest_logs and the artifact/telemetry siblings without needing their schemas.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives explicit use cases (debug bot errors, verify a running strategy) and a concrete alternative path: for failed/stalled deployments use diagnosticPreset="broker_order_failure" or "runtime_failure" with contextLines=5-10 and limit ~1000. It also warns against concluding from a single page when nextToken is present.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.