defend_metaAssess D3FEND coverage against ATT&CK techniques, revealing mapped domains and identifying areas with no coverage.
Return how much of ATT&CK the D3FEND mapping actually covers, including which domains have no coverage.
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||
Changes observed during successful MCP inspections.
v1.0.0Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are present, so the description carries the behavioral burden. It clearly frames the operation as read-only via 'Return' and exposes an honest behavioral nuance by saying 'actually covers' and 'no coverage,' indicating it reports real gaps rather than nominal coverage. It does not discuss data freshness or response granularity, but nothing is hidden about side effects.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
One focused sentence, front-loads the action and subject, and ends with the most decision-relevant detail (no-coverage domains). No filler or redundant restatement of the name/title.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a no-parameter metadata tool with no output schema, this gives enough for an agent to select and invoke it: the target dataset, the comparison to ATT&CK, and the expected negative result. It is not a 5 because 'how much' is ambiguous—count, percentage, or per-domain breakdown—and no output schema exists to resolve that.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has zero properties and the 0-parameter baseline applies; there are no parameter semantics for the description to add. The 100% schema coverage means the empty schema already fully documents the lack of inputs.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a concrete verb and object: 'Return how much of ATT&CK the D3FEND mapping actually covers.' It also adds a distinguishing deliverable—'which domains have no coverage'—so it reads differently from sibling tools like defend_search or defend_countermeasures.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no explicit when-to-use or when-not-to-use guidance, and no sibling is named as an alternative. The intended use case (checking D3FEND coverage and limits) is implied by the title and the phrase 'mapping actually covers,' but the agent must infer when this beats defend_search or attack_meta.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.