get_security_events

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description must convey behavioral traits. It only states that elevation is required, but does not disclose whether the operation is read-only, what the typical output size is, or any side effects. This is minimal for a tool that fetches security events.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is very concise with a single sentence, front-loading the key purpose and a critical requirement. It could be improved by structuring it with parameter hints or usage notes, but it avoids unnecessary words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the complexity of security event retrieval and the presence of sibling tools like query_event_log, the description is incomplete. It does not explain the return format, output schema, or how the parameters affect results. The agent lacks context to use the tool reliably.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The description does not mention the two parameters (max_events, hours_back) at all, despite 0% schema description coverage. The schema provides defaults, but the agent receives no guidance on how to use these parameters effectively.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it is a convenience for specific security event IDs (4688, 4624, 4672, 4648), which distinguishes it from the general query_event_log sibling tool. The verb 'get' and resource 'security events' are specific and unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage as a convenience for the listed event IDs, but it does not explicitly state when to use this tool versus alternatives like query_event_log. The mention of 'requires elevation' warns about a prerequisite, but no when-not or alternative conditions are provided.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.