indicators_insert

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries full behavioral burden. It discloses the upsert nature, permission requirements, and the critical overwrite behavior when rule_id matches. It could also mention what happens to unspecified fields on update, but the key traits are well covered.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with a short summary, a critical note, permissions, endpoint, and an example. Every section adds value and the example is essential for understanding the JSON body. It is not overly verbose despite the example and is easy to scan.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a write operation with a single array parameter and no output schema, the description is fairly complete: it covers the operation type, permissions, the subtle rule_id behavior, and gives a realistic example. It lacks information about response format or error cases, but those are not critical for basic use with siblings present.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%, so the description must compensate. It provides a concrete example request body that demonstrates the structure of request_data and sample values for most fields. It also explains the meaning and behavior of rule_id in prose, which is not obvious from the schema. However, it does not field-by-field explain every parameter, leaving some reliance on the schema's enums.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states 'Insert or update IOCs' which is a specific verb+resource, and it distinguishes itself from sibling tools like indicators_insert_jsons and indicators_insert_csv by focusing on direct JSON insertion. It also provides the exact endpoint, making the purpose unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives clear context for use: it's for inserting/updating IOCs with a JSON body, requires Instance Administrator permissions, and warns about rule_id tenant-specific behavior. However, it does not explicitly mention when to use this over the csv or jsons variants, so it lacks explicit alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.