attack_detectionRetrieve the MITRE ATT&CK v19 detection strategy for any technique, including analytics, log sources, and tunable fields, to improve threat detection and response planning.
Return the ATT&CK v19 detection strategy for a technique. With analytics, includes log sources and tunable fields.
| Name | Required | Description | Default |
|---|---|---|---|
| id | Yes | ATT&CK technique id | |
| analytics | No | Include full analytic detail |
Changes observed during successful MCP inspections.
v1.0.0Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the burden. It discloses that 'with analytics' the output includes log sources and tunable fields, which is a useful behavioral detail. However, it does not explicitly state that this is a read-only operation, nor does it mention error handling (e.g., what happens if the technique id is invalid). The word 'Return' implies a safe read, but more transparency would be better.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is only two sentences and gets to the point immediately. The primary purpose is stated first, and the conditional nuance about analytics follows. There is zero fluff, and every word earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a retrieval tool with two parameters (one required) and no output schema, the description is quite complete. It explains what the tool returns and the effect of the optional parameter. It does not mention return format or error behavior, but these are not critical for a straightforward fetch operation. The description is adequate for an agent to use the tool correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so both parameters are documented. The description adds meaning for the 'analytics' parameter by clarifying that it includes 'log sources and tunable fields', which goes beyond the schema's vague 'Include full analytic detail'. This extra explanation helps the agent understand the impact of setting analytics to true. The 'id' parameter is already clear in the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific action ('Return the ATT&CK v19 detection strategy') and a specific resource ('for a technique'), and distinguishes this tool from siblings like attack_mitigations and attack_related by focusing on detection strategy. The version number (v19) adds precision. An agent can clearly tell what this tool does.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives clear context that this tool is for detection strategy, which implies it is not for mitigations or related techniques. However, it does not explicitly name alternatives or state when not to use it. The sibling list makes the separation obvious, but no explicit exclusion is given.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.