fahali_get_incident_timeline

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnly/idempotent/non-destructive, so the bar is lower, and the description still adds real value: results are derived from the verdict history rather than copied, preserving original hashes and methodology version, and rows are ordered and tagged by verdict stage. It omits practical behavior such as the limit ceiling or the default inclusion of withheld rows.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Three sentences, front-loaded with the core action, and each sentence carries distinct information (purpose, provenance, use case). Slightly dense branding ('immutable verdict', 'Fahali recorded') adds a little weight without harm.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists and read-only annotations cover the safety profile, so return values and risk need not be restated. What remains thin is guidance on narrowing a long timeline via since/limit and the detail projections, plus when not to use this tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is only 67% (incident_id and limit carry no description), and the description mentions none of the six parameters — not the since lower bound, the brief/standard/audit detail projections, the symbols filter, or include_withheld. An agent must infer all of that from the schema alone.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (replay) and resource (immutable verdicts inside one incident's window), plus the ordering and the opening/intermediate/resolving tagging — far more precise than a bare 'get timeline'. It implicitly separates itself from generic siblings like fahali_get_verdict_history by scoping to a single incident, but never names an alternative outright.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The closing line gives a clear use case: 'answer what Fahali knew, and when, across the life of a breach.' That sets context well, but there are no exclusions (e.g. when to prefer fahali_get_verdict_history, fahali_get_active_incidents, or fahali_get_evidence instead).

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.