edl_lookup

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and destructiveHint=false, making the '[READ-ONLY]' prefix redundant. However, the description adds genuine value beyond the annotations by disclosing the dual data sources (Panorama config plus live firewall content) and by noting that EDL exception lists are included in the lookup — behavioral details an agent would not infer from the annotations alone.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

One dense sentence front-loads the read-only nature and packs in purpose, scope, and exception-list coverage without wasted words. The '[READ-ONLY]' prefix slightly duplicates the readOnlyHint annotation, but overall the length is appropriate and every clause earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a read-only membership-check tool with 100% schema coverage, safety annotations, and no output schema, the description adequately covers the query value, data sources, and exception behavior. The only gap is the lack of a stated return format (e.g., which EDL matched vs. a simple boolean), but the tool's behavior is simple enough that an agent can reasonably infer the result.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% with meaningful per-parameter descriptions, so the baseline of 3 applies. The main description restates the value domain ('IP, domain or URL') that the schema already documents and contributes little parameter-level semantics beyond what the structured schema provides.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb and resource — 'Checks whether an IP, domain or URL is present in the External Dynamic Lists applying to a firewall' — and adds distinguishing scope: config from Panorama, current firewall content, and EDL exception lists. This clearly differentiates it from siblings like userid_lookup, test_security_policy_match, and test_url_category, all of which serve different purposes.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies its use case (verifying EDL membership) through purpose clarity, but it never explicitly names alternatives or states when-not-to-use conditions, such as 'for user mapping use userid_lookup.' Some guidance exists at the parameter level — 'Usually omit it: the firewall is chosen from device_group, or from the user's/IP's recent traffic' — but no comparative routing is present in the main text.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.