Walk the ATT&CK graph from a technique

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description must carry behavioral disclosure. It does indicate pagination through 'Page through' and flags that usedBy results 'can be very large.' It does not describe edge-specific behavior, return formats, or whether the operation is strictly read-only, so transparency is partial.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences, front-loaded with the main action, and every sentence has purpose. The usedBy tip is useful and does not waste space, though the first sentence is slightly vague.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers the basic purpose and warns about pagination-heavy usedBy results, but it omits semantics for the other edge values and gives no guidance for choosing among the sibling ATT&CK tools. Given no output schema and sparse parameter descriptions, it is adequate but not fully complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is only 25%, and the description must compensate for the undocumented parameters. It adds meaning for the usedBy edge by linking it to groups and software, but it does not explain the subtechniques or parent edges, nor does it clarify page and perPage semantics beyond what the schema provides.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific action ('Page through') and a resource ('what relates to a technique'), which clearly identifies the tool's purpose. It does not explicitly distinguish itself from sibling tools like attack_get or attack_search, so it stops short of a 5.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The hint to 'Use usedBy for groups and software' gives practical direction and warns about large result sets. However, it does not state when to prefer this tool over the sibling ATT&CK tools or when to avoid it, leaving the usage guidance mostly implied.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.