yara_scan

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden, and it does disclose the runtime dependency (yara-python) and that results are matched rules with string offsets. However, it omits key behavioral detail: what happens when neither rules_source nor rules_file is supplied (both are nullable with null defaults), and it doesn't state that the operation is read-only.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Two tight sentences, front-loaded with the core action, then parameter guidance, then return-value note. Every clause adds information and nothing is wasted.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

A return value note is present even though an output schema exists, and the dependency requirement is called out, which covers most of what an agent needs. The remaining gap is the unstated behavior when both rules parameters are omitted, which matters given they are optional with null defaults.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%, so the description must compensate, and it partially does by framing rules_source and rules_file as alternative ways to supply rules. It does not state whether they are mutually exclusive or required, does not clarify error behavior if neither is given, and says nothing about path semantics beyond "a file".

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ("Scan a file with YARA") and clearly routes the agent to the YARA matching concept, which is distinct from siblings like identify_file, extract_strings, or pe_info. It stops short of explicitly differentiating itself from those siblings, but the purpose is unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies when to use it (YARA pattern scanning) and gives a useful prerequisite, requiring yara-python, plus guidance on supplying rules. It offers no when-not guidance or explicit comparison to alternatives such as extract_strings or identify_file, leaving the agent to infer the choice.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.