dora

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries full burden. It does add context by naming the external HaveIBeenPwned source and regulatory use case, but it does not disclose rate limits, required permissions, or response behavior. The read-only nature is only implied by 'check'.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short sentences front-load the data source and purpose, with no filler. The DORA reference adds useful context in a single phrase. Every word earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple tool with only two optional parameters and no output schema, the description is mostly sufficient. However, it does not mention what the response contains (e.g., breach names, dates) or the impact of the limit parameter, leaving some ambiguity about the return format.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% with clear descriptions for both domain and limit, so the schema does the heavy lifting. The description adds little beyond 'domain/company breach exposure' and does not provide additional parameter context or examples beyond what the schema already includes.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool checks domain/company breach exposure via the HaveIBeenPwned database, which is a specific verb+resource+scope. It distinguishes from siblings by focusing on breach exposure rather than CVEs, advisories, or threat actors.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The DORA Art. 18 reference implies it is used for incident assessment, but it does not explicitly state when to use this over alternatives like cve_search or kev_check. No exclusions or alternative tool names are provided, leaving usage mostly implied.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description must disclose behavioral traits. It fails to mention what the tool returns (e.g., list of advisories), whether it supports filtering/searching, pagination, rate limits, or data format. The description only specifies the data source and purpose, not how the tool behaves.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, front-loaded sentence that conveys the core identity and use case without unnecessary words. It earns its place by providing authoritative context and regulatory relevance, making it appropriately concise.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With 2 optional parameters and no output schema, the description should explain the return shape and behavior. It only says 'advisories' without indicating whether results are sorted, paginated, or formatted. The tool is simple, but the lack of return-value information leaves the description incomplete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema covers 100% of the parameters with clear descriptions ('Max results 1-30', 'Filter by keyword'), so the baseline is 3. The description adds no parameter-specific semantics beyond what the schema already provides, leaving the parameters self-explanatory.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description identifies the resource as 'CERT-Bund security advisories' and adds context about being an authoritative German source for ICT threats. However, it lacks an explicit verb like 'list', 'fetch', or 'search', so the exact action is implied by the tool name rather than clearly stated.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description mentions 'DORA Art. 17 threat monitoring', which implies a specific use case for regulatory compliance. It does not explicitly state when to prefer this over sibling tools like cve_search or kev_check, nor does it provide exclusions or alternative guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden. It communicates that the tool returns live status and has a regulatory angle, but it does not disclose that it returns incident lists, data freshness, or absence of side effects. The schema adds some context, but the description itself adds minimal behavioral detail.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Two concise sentences, front-loaded with the core purpose. The DORA regulatory context is added without bloat, and no schema information is redundantly repeated.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple read-only tool with two optional parameters, the description provides sufficient context about cloud providers and regulatory relevance. It lacks explicit output format details, but the schema's 'incidents per provider' hints at the data structure, making the tool adequately complete for its simplicity.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% with both 'limit' and 'provider' fully described. The description adds no parameter-specific meaning beyond what the schema already provides, so the baseline score of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool provides live status of AWS, GCP, and Azure cloud providers. The DORA Art. 28 reference adds regulatory context that distinguishes it from sibling tools like cve_latest or breach_check, showing a specific verb+resource with unique scope.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

No explicit when-to-use or alternative guidance is provided. The DORA context implies use for third-party ICT risk monitoring, but it does not mention situations where this tool should be preferred over siblings like provider_risk. Usage is implied rather than stated.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description must convey behavioral traits such as read-only operation, output format, or data source. It only mentions 'latest critical CVEs' and filtering, leaving the agent to infer that this is a safe query tool. The absence of any disclosure about response structure or limitations is a gap.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, tightly packed sentence that front-loads the core purpose and immediately mentions filtering. There is no fluff or repetition; every word earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the lack of an output schema and annotations, the description is too sparse. It does not explain what the 'briefing' includes, how results are returned, or any edge cases. With four optional parameters, more context about the intended response would make the tool easier to invoke correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3. The description's reference to 'severity and banking relevance' merely echoes the existing schema descriptions for severity and banking_only, adding no new semantic detail beyond what structured data already provides.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool provides the latest critical CVEs, with a focus on daily DORA ICT risk briefings. It distinguishes itself from sibling tools like cve_search by emphasizing recency and criticality, though it lacks an explicit verb like 'retrieve' or 'list'.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The phrase 'daily DORA ICT risk briefing' implies a recurring use case, and the mention of filters suggests how to narrow results. However, it does not explicitly state when to use this tool versus alternatives like cve_search or kev_list, nor does it provide exclusions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the burden of behavioral disclosure. It mentions returns (CVSS scores, attack vectors, DORA pillar mapping) but does not detail safety (read-only), rate limits, or edge cases like empty results. It adds some context but leaves gaps.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single concise sentence that efficiently packs the tool's purpose and key outputs. No filler words, and every phrase adds value.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a search tool with five parameters and no output schema, the description covers the core behavior and return values. It omits details like pagination or result formatting, but the schema covers parameters. It distinguishes from sibling tools adequately, making it fairly complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, meaning every parameter is described in the schema. The description adds high-level context (keyword, vendor, product) but not detail beyond the schema. Baseline of 3 applies as the schema does the heavy lifting.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool searches CVEs by keyword, vendor, or product, which is a specific verb+resource combination. It also differentiates from siblings like cve_latest (which likely lists latest CVEs) by emphasizing search functionality and DORA pillar mapping.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage for vulnerability research with filters, but does not explicitly state when to use it versus alternatives like kev_check or cve_latest. It lacks clear exclusions or alternative tool references, so guidance is only implied.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden of behavioral disclosure. However, it only describes what the calendar contains (milestones, deadlines, Art. references) and does not mention data freshness, whether it is static or dynamic, or any other behavioral characteristics. This is thin for a tool with no annotation support.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single well-structured sentence that front-loads the core content (DORA compliance milestones and deadlines) and then adds a relevant detail (Art. references). There is no wasted wording.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool is simple (no parameters, no output schema), and the description communicates its purpose adequately. However, it leaves out details like the time range covered, update frequency, or whether it returns a list of items, which would help a user understand what to expect. It is minimally viable but not rich.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

There are zero parameters, so the schema is trivially fully covered. The description adds a small piece of extra meaning by noting 'All Art. references included,' which is beyond the schema. The baseline for 0 params is 4, and the description does not detract from that.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool provides DORA compliance milestones and upcoming deadlines for financial institutions, with a specific audience and content focus. It does not explicitly distinguish from siblings, but the sibling names are largely distinct topics (security threats, advisories), so ambiguity is low.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies the tool is for checking DORA-related deadlines and milestones, but it does not provide explicit when-to-use or when-not-to-use guidance, nor does it mention alternatives. The context is helpful but the guidance is only implied.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

There are no annotations provided, so the description must disclose behavioral traits on its own. The text only states the tool's topic area and does not explain that it retrieves articles, whether it is read-only, any pagination behavior, or potential rate limits. For a simple news lookup this might be low-risk, but the description still fails to explicitly confirm the read-only nature or return characteristics.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, focused sentence that front-loads the core purpose ('EBA/DORA regulatory news for banks') and immediately lists relevant topics. There is no unnecessary fluff or repetition. The structure is clean and easy to scan, though it could be slightly more organized (e.g., separating the topic list into a bulleted list) to improve readability.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's simplicity (3 optional parameters, no output schema), the description adequately conveys what the tool is about and lists topics. However, it does not describe the response format (e.g., list of news articles with titles/links) or any filtering behavior beyond what schema parameters imply. Since there is no output schema to fill that gap, a brief mention of return structure would make it more complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema fully describes each parameter (lang, limit, topic) with types, defaults, and ranges, giving a 100% schema coverage. The description adds some context by listing popular topics, which reinforces the parameter values, but it omits 'fintech' that appears in the schema. Overall, the description does not significantly enhance what the schema already provides, so the baseline score of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly identifies the resource as 'EBA/DORA regulatory news for banks' and lists relevant topics, making the tool's purpose evident. However, it lacks an explicit action verb like 'Get' or 'List', instead using a noun phrase that implies retrieval. It does distinguish itself from sibling tools by focusing on regulatory news rather than breaches, CVEs, or advisories.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The tool's use case is implied: it is for retrieving DORA/regulatory news, and the topic list suggests when to use it (e.g., for 'incident' or 'third_party' news). However, there is no explicit guidance on when not to use it or how it relates to sibling tools like dora_calendar or incident_timeline. The absence of exclusions or alternative tool references leaves some ambiguity.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure. It mentions 'status' and 'checks' which imply read-only behavior, but it does not explicitly state that the operation is non-destructive, what kind of output to expect, or whether any side effects or permissions are involved. This is a minimal disclosure, but the inference of a passive health check is fairly strong.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single concise sentence that front-loads the tool name and core purpose. Every word earns its place, and there is no filler or redundant information. It is appropriately sized for a simple tool with no parameters.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's simplicity (no parameters, no output schema), the description covers the basic purpose: checking DORAOracle server status and backend connectivity. However, 'all backend connectivity checks' is vague—it does not enumerate which backends or what kind of status reporting is done. A bit more detail on the scope or output would make it more complete, but it is not critically inadequate.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters, so the description has no need to explain parameter semantics. The baseline for 0 parameters is 4, and the description appropriately focuses on the tool's purpose without irrelevant parameter details.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description 'DORAOracle server status and all backend connectivity checks' clearly identifies the tool's function as checking server and backend health. It distinguishes this from sibling tools like cve_search or breach_check by focusing on infrastructure status rather than security data. However, it lacks an explicit verb, making it a noun phrase rather than an action statement.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

No usage guidance is provided. The description does not state when to use this tool versus alternatives, nor does it mention contexts where it should be avoided. The purpose is implied but there is no explicit 'use this when' or 'for X use sibling tool Y'.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries full burden. It discloses a key behavioral caveat (not compliant reporting) but does not elaborate on the output structure or any other behavioral traits, which would be valuable for an agent.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences, highly concise, and front-loaded with the core purpose. The disclaiming phrase is earned and valuable; no waste.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's simplicity, complete schema coverage, and no output schema, the description sufficiently conveys the purpose and a critical limitation. It doesn't detail output format, but that is less essential with no output schema and a clear generation role.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents all three parameters. The description adds no additional semantic value beyond what the schema provides, so the baseline of 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool generates a DORA Art. 19-aligned reporting timeline with regulatory deadline structure. The disclaimer 'Supports - does not constitute - compliant reporting' adds important nuance, but it does not differentiate from sibling tools like dora_calendar.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no explicit guidance on when to use this tool versus alternatives. The description implies usage for generating reporting timelines but does not state prerequisites, exclusions, or alternatives, leaving the agent to infer.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the burden. It discloses that it 'Returns DORA incident classification guidance', which is an additional behavioral trait beyond a simple boolean. The verb 'Check' implies a read-only operation, but it does not explicitly state that there are no side effects or describe error handling.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The entire description is one sentence with two clear clauses. No filler or redundant information. It earns its place by communicating the core function and an unexpected output feature.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool is simple (1 param, fully documented), and the description covers purpose and an additional output (DORA guidance). It does not specify the exact return format or behavior for non-KEV CVEs, but for a straightforward check tool, this is reasonably complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema covers 100% of the parameter with a description including an example. The tool description adds minimal extra meaning beyond the schema, simply reinforcing that it checks a 'specific CVE'. With full schema coverage, a baseline of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's function: 'Check if a specific CVE is in CISA KEV' with the specific verb 'Check' and resource 'CISA KEV'. It distinguishes from siblings like kev_list (likely lists all KEV entries) and cve_search (general CVE search) by emphasizing 'specific CVE'.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies when to use: when you have a specific CVE to verify against CISA KEV. It does not explicitly mention alternatives or exclusions, but the context is clear enough given the sibling names. Lacks explicit 'use this instead of...' guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are present, so the description must carry the full burden. It states the content (actively exploited CVEs with deadlines) but does not disclose filtering defaults, pagination, or any side effects. It is arguably a read-only operation, but that is not explicitly stated.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description consists of two terse, informative sentences with no redundant wording. It front-loads the key concept (CISA KEV) and adds compliance context efficiently.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple list tool, the description covers the subject matter and compliance context, while the schema handles parameter details. Without an output schema, the description does not specify return fields, but this is acceptable given the straightforward nature of the tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

All four parameters are fully described in the schema with defaults and examples, so the description does not need to add much. The mention of patch deadlines complements the 'overdue' parameter but adds no new syntax or format details beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly identifies the tool as providing CISA Known Exploited Vulnerabilities with patch deadlines, and ties it to DORA Art. 9 compliance. However, it does not explicitly distinguish from sibling tools like kev_check or cve_search, so it is not a full 5.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The mention of DORA Art. 9 patch compliance suggests a compliance use case, but there is no explicit statement of when to use this tool over alternatives like cve_search or kev_check. No exclusions or alternative directives are provided.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of disclosing behavior. However, it only states what the tool is about, not how it behaves (e.g., read-only, pagination, return format, permissions). The description is purely domain-focused and omits any operational details.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence and is very concise. It front-loads the main subject ('MITRE ATT&CK techniques') and adds relevant regulatory context. However, it is so terse that it reads more as a noun phrase than a functional instruction, limiting its completeness.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

This tool has no annotations, no output schema, and 3 optional parameters. The description fails to explain what the tool returns, whether it lists/searchs, or how to combine filters. It is too sparse to be considered complete for an agent to use effectively without further inspection.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema fully describes all three parameters (limit, tactic, keyword) with explicit descriptions, achieving 100% schema coverage. The description adds no additional parameter context, but the schema already provides the needed semantics, so the baseline score of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description identifies the resource (MITRE ATT&CK techniques) and the context (DORA TLPT/TIBER-EU), which distinguishes it from sibling tools, but it lacks an explicit verb like 'list' or 'search'. This makes the tool's action somewhat vague and relies on inference from the schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is given on when to use this tool versus alternatives such as cve_search or threat_actors. The context mentions DORA TLPT/TIBER-EU, but there is no explicit statement about when this tool is preferred or when other tools are more appropriate.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description must disclose behavior. It mentions content areas but does not state whether the tool performs read-only lookups, fetches live data, requires permissions, or returns a structured report. This is a significant gap for a tool that appears to aggregate multiple data sources.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, information-dense sentence. It front-loads the primary purpose (DORA Art. 28 ICT third-party risk assessment) and then lists four distinct content categories without unnecessary words. Every element earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool seems complex given the combination of four content areas and the absence of an output schema or annotations. The description lists what is covered but does not explain the return structure, how the provider parameter influences results, or any prerequisites. It is partially complete but leaves meaningful gaps.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema already provides full coverage for the single 'provider' parameter with examples (SAP, Salesforce, AWS, Temenos). The description adds DORA context but does not elaborate on parameter syntax, format, or constraints beyond what the schema offers, so the baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly identifies the tool as a DORA Art. 28 ICT third-party risk assessment and lists specific components (CVE history, news, GLEIF registration, contractual checklist). This distinguishes it from sibling tools that focus on individual topics, though it uses a noun phrase rather than an explicit verb like 'generate' or 'assess'.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The DORA Art. 28 reference provides a clear context for when to use this tool—when a third-party risk assessment is needed. However, it does not explicitly mention alternatives or state when not to use it, leaving the comparison to sibling tools (e.g., cve_search, dora_news) implicit.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden. It discloses the feed is 'live' and that output is an 'actionable IP blocklist', but it does not mention authentication, rate limits, output format, or whether it requires any special access. This is a significant gap for a tool with no structured safety hints.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two short clauses in one sentence, front-loaded with the core resource and followed by practical context (DORA Art. 9). No filler or redundant information is present.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple 3-parameter list tool, the description covers the key context: live C2 data, malware relevance, and the actionable output. It does not explain return structure in detail, but the absence of an output schema is mitigated by the clear 'IP blocklist' statement. It is adequate for the tool's simplicity.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, with limit, status, and malware all described. The description adds no extra meaning beyond the schema; it merely echoes the malware family names in parentheses, so it earns the baseline of 3 for high schema coverage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description identifies a specific resource (live C2 botnet servers from Feodo Tracker) and the malware families covered (Emotet, QakBot, etc.), making it distinct from sibling tools like CVE or KEV feeds. It lacks an explicit action verb like 'list' or 'search', but the resource and context are unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage for retrieving IP blocklists for threat actors, especially in DORA Art. 9 contexts. It does not explicitly compare with alternatives or state when not to use it, leaving the agent to infer from the threat-intel theme.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It does not explicitly state whether the tool is read-only, what output format is expected, or any limitations (e.g., TIBER-EU only). It only describes the content domain, not the behavioral traits, so the agent cannot fully anticipate the tool's side effects or return value.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two short sentences and front-loads the core concept. No wasted words, making it highly concise and well-structured.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool is simple with two optional parameters and no output schema, so the description needs to convey the return type and context. It provides the context (DORA planning) but does not state what the returned scenarios look like or how many are returned. This is a moderate gap given the absence of an output schema.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema already provides complete descriptions for both parameters, including default values and allowed values for 'focus'. The description adds no additional parameter-level meaning, so the baseline score of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly identifies the resource as TIBER-EU threat scenarios for DORA resilience testing, and the mention of 'Banking-specific attack simulations' distinguishes it from sibling tools like dora_calendar and threat_actors. However, it lacks an explicit action verb (e.g., 'retrieve' or 'list'), making the intended operation slightly implicit. Still, the purpose is specific and unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description states the context ('for DORA resilience testing planning') and the banking focus, which tells the agent when this tool is relevant. It does not explicitly mention alternatives or exclusions, but the clear use case is sufficient for a 4.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.