MITRE ATT&CK MCP Server

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries full burden but provides minimal behavioral context. It mentions default values for parameters but doesn't describe error handling (what happens with invalid STIX IDs), performance characteristics, or authentication requirements. The description doesn't contradict annotations (none exist), but fails to provide important operational context for a lookup tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is efficiently structured with a clear purpose statement followed by parameter explanations. Every sentence adds value, though the formatting with 'Args:' header is slightly redundant given the schema exists. The information is front-loaded with the core purpose first.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 3-parameter lookup tool with no annotations and no output schema, the description provides adequate but incomplete coverage. It explains parameters well but doesn't describe the return format, error conditions, or relationship to the broader MITRE ATT&CK context evident from sibling tools. The description meets minimum requirements but leaves gaps for operational use.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 0% schema description coverage, the description compensates well by explaining all three parameters: 'technique_stix_id' is 'Subtechnique STIX ID to check what its parent technique is', 'domain' specifies 'enterprise', 'mobile', or 'ics', and 'include_description' controls output inclusion with default False. This adds crucial meaning beyond the bare schema, though it could elaborate on STIX ID format expectations.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: 'Get parent technique of subtechnique' - a specific verb ('Get') and resource ('parent technique') relationship. It distinguishes from siblings like 'get_all_parent_techniques' (which lists all) and 'get_subtechniques_of_technique' (which does the inverse). However, it doesn't explicitly mention the MITRE ATT&CK framework context that's implied by the sibling tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage when you have a subtechnique STIX ID and want its parent, but doesn't provide explicit guidance on when to use this versus alternatives like 'get_object_by_stix_id' or 'get_all_parent_techniques'. It mentions the domain parameter options but doesn't explain when to choose different domains or what happens if you use the wrong one.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.