search_alerts

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description bears the full burden of behavioral disclosure. It provides useful context: OCSF query syntax, default region fallback to TAEGIS_ENVIRONMENT and then 'charlie', a maximum limit of 10,000, and a return format of a JSON array. It does not mention rate limits or pagination, but for a read-only search tool this is largely sufficient.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with a purpose sentence, an Args section, and a Returns section. It is slightly longer than necessary but every sentence adds value—example query, default behavior, and result format. Front-loading the core purpose makes it easy to scan.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool has 3 parameters (1 required) and an output schema, so the description doesn't need to detail return fields. It covers input syntax, defaults, limits, and return type. It could mention whether the search spans all tenants, but for an alert search tool this is adequate and contextually aligned with its sibling search tools.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must fully explain parameters. It does so exceptionally: query is described with a concrete OCSF example, region lists example values (charlie, delta, us1, us2, eu) and default resolution, and limit specifies default (100) and max (10,000). This far exceeds the schema's minimal titles.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description 'Search Taegis alerts using OCSF query syntax' clearly specifies the verb (search), resource (Taegis alerts), and query syntax (OCSF). This distinguishes it from sibling tools like search_events and search_investigations, which target other data types.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage by stating 'Search Taegis alerts' but does not explicitly mention when to use this tool versus alternatives or provide exclusions. It lacks the explicit alternative guidance seen in high-scoring examples, but the context is clear enough for an agent to infer.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.