login_storm_analysis

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries full burden. It clearly marks the tool as READ by starting with '[READ]'. It describes what the tool does (detects storms, flags slow sessions) and what it returns (dict with fields). It does not mention any destructive side effects, and no contradictions arise.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with a concise opening line, a guiding question, parameter list, return value description, and example. It is front-loaded with key purpose. Slightly verbose but every sentence adds value for a complex tool.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the complexity (7 params, no output schema, 0% schema coverage), the description is complete. It covers purpose, parameter semantics, return structure, and provides an example. The agent can fully understand how to invoke and interpret results.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, but the description provides thorough parameter explanations for all 7 parameters, including defaults (e.g., 'default 24'), units (ms, s), and behavior (e.g., 'Pass sessions for pure analysis'). This adds significant meaning beyond the bare schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: 'Detect login storms + rank the slowest login/boot contributors.' It specifies the action (detect and rank) and the resource (login storms and slow contributors), and distinguishes it from sibling tools like 'session_list' or 'endpoint_list' by focusing on storm analysis.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides explicit context for when to use: 'Answers is this a morning login storm...' It also gives guidance on input options: 'Pass sessions for pure analysis, or a target to pull live via session_list.' However, it does not explicitly state when NOT to use or name alternative tools for different scenarios.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.