Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It discloses the read-only nature via 'List', scoping via 'visible to the authenticated user', and return format via 'JSON array of tenant objects.' It does not mention pagination or errors, but for a simple listing tool this is adequate.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two short sentences: one for the action and one for the return format. It is front-loaded with the verb and includes no unnecessary words, earning maximum conciseness.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with zero parameters and an output schema, the description is complete: it states the primary function and the return type. The presence of an output schema means the description does not need to detail return fields beyond the summary provided.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has zero parameters, so no parameter semantics are needed. The baseline for 0-parameter tools is 4, and the description correctly implies no parameters are required.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb 'List' with a clear resource 'Taegis tenants' and scope 'visible to the authenticated user.' It clearly distinguishes itself from the sibling search tools (search_alerts, search_events, etc.) which are query-based rather than a simple listing operation.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides no guidance on when to use this tool versus alternatives. It does not mention use cases such as retrieving tenant IDs before running searches, nor does it exclude any scenarios. The usage is implied but not explicitly stated.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description must fully disclose behavior. It states that it runs arbitrary commands and returns raw JSON, which is transparent about the action and output. However, it gives no warning about potential side effects or errors, which would be valuable for an arbitrary-command tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with clear sections (overview, Args, Returns). It is front-loaded with the main purpose and every sentence adds value, with no redundancy or filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For an escape-hatch tool, the description covers what it does, how to invoke it, and expected output. It does not mention authentication or error handling, but these are less critical for a generic wrapper and the sibling tools handle specific contexts.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The description thoroughly explains the 'args' parameter: space-separated CLI arguments after the binary, with a concrete example. Even though schema coverage is 0%, the description fully compensates for this single parameter.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it runs an arbitrary taegis CLI command and returns JSON output. It explicitly identifies itself as an escape hatch, which distinguishes it from sibling tools that wrap specific searches.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description says to use it for commands not yet wrapped as dedicated tools, which implies when to use it. It does not explicitly say 'use dedicated tools when available' as an exclusion, but the escape hatch framing provides clear context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description bears the full burden of behavioral disclosure. It provides useful context: OCSF query syntax, default region fallback to TAEGIS_ENVIRONMENT and then 'charlie', a maximum limit of 10,000, and a return format of a JSON array. It does not mention rate limits or pagination, but for a read-only search tool this is largely sufficient.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with a purpose sentence, an Args section, and a Returns section. It is slightly longer than necessary but every sentence adds value—example query, default behavior, and result format. Front-loading the core purpose makes it easy to scan.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool has 3 parameters (1 required) and an output schema, so the description doesn't need to detail return fields. It covers input syntax, defaults, limits, and return type. It could mention whether the search spans all tenants, but for an alert search tool this is adequate and contextually aligned with its sibling search tools.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must fully explain parameters. It does so exceptionally: query is described with a concrete OCSF example, region lists example values (charlie, delta, us1, us2, eu) and default resolution, and limit specifies default (100) and max (10,000). This far exceeds the schema's minimal titles.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description 'Search Taegis alerts using OCSF query syntax' clearly specifies the verb (search), resource (Taegis alerts), and query syntax (OCSF). This distinguishes it from sibling tools like search_events and search_investigations, which target other data types.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage by stating 'Search Taegis alerts' but does not explicitly mention when to use this tool versus alternatives or provide exclusions. It lacks the explicit alternative guidance seen in high-scoring examples, but the context is clear enough for an agent to infer.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description must carry the burden of behavioral disclosure. It adds useful context by explaining the default region derived from TAEGIS_ENVIRONMENT, the default limit, and the return format as a JSON array. However, it does not disclose potential side effects, error behavior, or rate limits, which are common for search tools.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a compact docstring with a one-line purpose, a short Args section, and a Returns line. It is front-loaded and concise, with no filler or redundant prose.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple search tool with an output schema, the description covers the essential purpose, parameters, and return type. However, it lacks usage guidance (when to choose this over sibling tools) and does not elaborate on query syntax, which prevents it from being fully contextually complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description is the sole source of parameter meaning. It explains 'query' as an event query string, 'region' as the Taegis environment with a default, and 'limit' as the maximum result count. While this adds value beyond the schema, 'query' lacks syntax or example details, leaving some ambiguity.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a clear verb and resource: 'Search Taegis security events.' This directly states the tool's function and distinguishes it from sibling tools like search_alerts, search_investigations, and search_threat_intel, which target different data types.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is given on when to use this tool versus alternatives like search_alerts or search_investigations. The description only covers mechanics (query, region, limit) and does not mention exclusions, prerequisites, or a decision framework.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are present, so the description must carry the full burden. It discloses the 'open' filter, default values, and return type, but omits details on permissions, side effects, or pagination. Adequate but not comprehensive.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise and well-structured, with a one-sentence purpose, an Args section, and a Returns section. Every sentence contributes directly to tool usage.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple search tool with two optional parameters and an output schema, the description covers the core scope, parameters, and return format. It could mention pagination or tenant context, but the essentials are complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The description adds meaning beyond the input schema: 'region' is explained as the Taegis environment with a fallback to an environment variable, and 'limit' is defined as the maximum number of results. This enriches the schema's minimal default-value definitions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's function: 'List and search open security investigations in Taegis.' The verb+resource combination is specific and distinguishes it from sibling tools like search_alerts and search_events.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies this tool is for investigation data, but it does not explicitly state when to use it over alternatives or provide any exclusions. Usage context is clear but not contrasted with siblings.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden for behavioral disclosure. It adds value by specifying the return type ('JSON array of threat intelligence objects') and the region default behavior ('Defaults to TAEGIS_ENVIRONMENT or "charlie"'). While it doesn't discuss pagination or rate limits, this is a simple search tool and the described behavior is adequate.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact and well-structured, with a single-purpose opening sentence and organized Args/Returns sections. Every sentence earns its place; there is no redundant or extraneous information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple two-parameter search tool, the description covers the essential context: what it searches, how parameters behave, and what is returned. The presence of an output schema means the description needn't list fields. It lacks explicit mention of potential pagination or permissions, but these are not critical for basic usage, making it nearly complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema has zero description coverage (only titles), so the description fully compensates. The Args section explains that 'query' is an 'indicator value or free-text search' and 'region' is 'Taegis environment/region' with an explicit default. This adds meaningful semantics beyond the bare schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with 'Search Taegis threat intelligence (IOCs, hashes, IPs, domains …)', which clearly states the tool's specific verb and resource. This also distinguishes it from sibling tools like search_alerts and search_events by focusing on threat intelligence rather than alerts or investigations.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage by naming the types of indicators (IOCs, hashes, IPs, domains) and the platform (Taegis), which gives clear context for when this tool is appropriate. However, it does not explicitly mention alternatives or exclusions, such as 'for security events use search_events', so it falls short of a 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.