Identify YARA rules for a ransomware group by name, enabling threat hunters to detect matching malware samples.
Get YARA rules associated with a ransomware group
| Name | Required | Description | Default |
|---|---|---|---|
| group | Yes | Name of the ransomware group |
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes | Raw YARA rule data for the ransomware group, as returned by the Ransomware.live API. The exact shape varies by group. |
Changes observed during successful MCP inspections.
v1.0.0Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and openWorldHint=true, covering the safety and data-nature profile. The description adds no further behavioral context such as whether rules are returned as text, URLs, or metadata. This is acceptable given the annotations exist, but the description itself carries little extra transparency.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, front-loaded sentence with no filler or repetition. Every word contributes to defining the tool's purpose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple read-only getter with one fully documented parameter and an output schema present, the description is sufficient. The agent knows exactly what input to provide and can rely on the schemas for the rest.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 100% coverage, describing 'group' as 'Name of the ransomware group'. The description reiterates this same relationship without adding format details, allowed values, or examples. Baseline 3 is appropriate since the schema already documents the parameter completely.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('Get') and a precise resource ('YARA rules') scoped to 'a ransomware group'. This clearly distinguishes it from sibling tools like get_iocs or get_mitre_ttps, since YARA rules are a distinct artifact type.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies the tool should be used when YARA rules for a specific ransomware group are needed. However, it does not mention any alternatives or exclusion criteria, leaving the comparison with sibling tools like get_iocs or get_mitre_ttps to the agent's inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.