Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure. It fails to mention any side effects, permissions, return format, or what 'advanced threat detection' actually does. The vague phrasing lacks any concrete behavioral traits, making it impossible for an agent to anticipate the tool's actions.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise but under-specified. The single sentence 'Perform advanced threat detection using behavioral analysis and pattern recognition' is a tautological restatement of the name and adds no informative value, similar to the 'Process' calibration example.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's implied complexity and lack of output schema or annotations, the description is completely inadequate. It does not explain what results are produced, how they are presented, or what the agent should expect after invoking the tool, leaving critical gaps for a tool with so many siblings.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% for the only parameter (session_id), so the baseline is 3. The description does not add any parameter-specific information beyond what the schema already provides, so it correctly stays at baseline.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description essentially restates the tool name ('advanced threat detection') and adds generic terms 'behavioral analysis and pattern recognition' without specifying what concrete actions or outputs are involved. It does not distinguish this tool from its many siblings such as detect_suspicious, quick_triage, or analyze_lateral_movement.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides no guidance on when to use this tool compared to alternatives. It does not mention any prerequisites, exclusions, or typical scenarios, leaving the agent with no context for selecting it over similar detection tools.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description must carry the full burden. It discloses the entropy threshold interpretation (>5.0 suggests encrypted data) but does not describe return values, side effects, or how session/stream data is processed.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise and front-loaded: the first sentence states the purpose, followed by a brief use-case list. The '【CTF必备】' prefix adds minor noise but is negligible.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with no output schema and no annotations, the description lacks information about what the analysis returns (e.g., entropy value, boolean flag) and how session_id/stream_index relate to the analysis. The schema covers parameter basics, but the description does not fully compensate for absent output details.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema covers all three parameters with descriptions. The tool description adds meaning to 'threshold' by specifying >5.0 indicates high entropy/encrypted data, which goes beyond the schema's generic 'High entropy threshold' label.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool analyzes Shannon entropy of data to detect encryption or compression, with a specific threshold (>5.0). It distinguishes itself from siblings like detect_suspicious or decode_stream by focusing on entropy analysis specifically.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly lists when to use the tool: user suspects encrypted payload, after finding random-looking data, and before attempting decryption. It does not mention alternatives or exclusions, but the provided use cases give clear guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries full responsibility for disclosing behavioral traits. It only mentions 'one-shot' and the input options, but does not describe side effects, safety profile, performance impacts, or what the tool does with the session/PCAP. This is a significant gap for a tool that likely processes network evidence.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is only two sentences, front-loaded with the key action and scope, with no wasted words. It efficiently communicates the tool's essence and input mechanism.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool has no output schema and no annotations, so the description must compensate by explaining what analysis entails and what the agent can expect in return. It does not mention output format, key indicators, or limitations, leaving the agent under-informed for a moderately complex analysis task.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3. The description adds value by clarifying that either session_id or pcap_path can be used ('or'), which suggests mutual exclusivity and guides parameter selection beyond the individual field descriptions. This lifts it above baseline.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's function: 'one-shot lateral movement analysis' with specific protocol types (SMB/NTLM/RDP). It distinguishes itself from sibling tools like detect_port_scan or analyze_rdp_attack_chain by focusing on lateral movement across multiple protocols.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The phrase 'one-shot' implies a single-pass execution, and 'accepts session_id or pcap_path' gives some input context. However, there is no explicit guidance on when this tool is preferred over alternative analysis tools, nor any exclusions or prerequisites. Usage is largely implied by the name rather than stated.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description must carry the full burden of behavioral disclosure. It discloses the core behavior (correlates, extracts hints) but lacks details on whether it is read-only, what 'forensic hints' entail, or any limitations. For an analysis tool, this is adequate but not rich.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise, two sentences, with the core purpose front-loaded. The Chinese prefix adds a stylistic element but does not harm clarity. Every sentence contributes meaningful information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with four parameters, no output schema, and no annotations, this description is too brief. It does not explain the output format (e.g., what forensic hints look like) or whether one input is preferred over the other. Given the complexity of RDP/NTLM attack chain analysis, more context is needed.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema covers all parameters with descriptions, so the baseline is 3. The description adds the key alternative between session_id and pcap_path, but does not elaborate on max_packets or auto_correlate, which are already well described in the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly identifies the tool's purpose: automated analysis of the RDP + NTLM attack chain, with explicit correlation of NTLM evidence with RDP sessions and extraction of forensic hints. This distinguishes it from sibling tools like analyze_lateral_movement or extract_ntlm_hashes by focusing specifically on the combined RDP/NTLM chain.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies when to use the tool (when investigating RDP/NTLM attack chains) and mentions two accepted input modes (session_id or pcap_path). However, it does not explicitly state when not to use it or what alternatives might be preferable, such as analyze_lateral_movement for broader lateral movement analysis.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description must carry the full burden of behavioral disclosure. It only states that the tool analyzes timing patterns; it does not disclose whether this is read-only, what the output looks like, or how anomalies are determined. The lack of any behavioral detail (e.g., output format, side effects, algorithm specifics) is a significant gap.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise: a single sentence followed by a focused list of three use cases. Every element contributes to understanding the tool's purpose and usage, with no redundant or filler content.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool has no output schema, and the description does not explain what the analysis returns (e.g., a list of suspicious intervals, scores, or timestamps). This leaves the agent guessing about the result format. While the purpose and parameters are clear, the missing return value information makes the description incomplete for an agent to use the tool effectively.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema covers 100% of the parameters with meaningful descriptions (e.g., 'Time interval for grouping', 'Standard deviation threshold for anomalies'). The tool description adds no additional parameter-level information; the schema already provides the necessary semantics, so a baseline score of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's action ('Analyze timing patterns') and its purpose ('detect beaconing or periodic communication'). It distinguishes itself from sibling tools like detect_port_scan and analyze_lateral_movement by focusing specifically on timing-based beaconing detection.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides explicit use cases: when C2 heartbeat is suspected, automated callbacks are sought, or anomaly detection in time series is needed. This gives clear context for when to use the tool, though it does not explicitly list alternatives or when not to use it.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden. It discloses the main actions and the output location ('extract loot to workdir/loot'), which implies filesystem writes. However, it does not mention whether it modifies PCAP state, what happens if neither session_id nor pcap_path is provided, or failure behavior. Some key behavioral traits are guessable but not explicit.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, information-dense sentence that front-loads the tool's purpose ('One-shot webshell analysis') and lists the steps in logical order. No filler or redundant wording.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

This is a complex multi-step pipeline with 6 optional parameters, no output schema, and no annotations. The one-sentence description omits what the tool returns, how results are presented, and how it handles edge cases like both session_id and pcap_path being provided. The description is insufficient for an agent to confidently invoke this tool in varied contexts.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the baseline is 3. The description adds the relationship 'Accepts session_id or pcap_path', which clarifies the input requirement, but it does not add meaning for the other parameters (loot_dir, max_packets, max_streams, min_confidence) beyond what the schema already describes. Minimal added value.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description explicitly names the tool as 'One-shot webshell analysis' and lists the full pipeline: enumerate HTTP streams, detect tool family, extract/guess key, decrypt, and extract loot. This clearly differentiates it from sibling tools like detect_webshell, extract_webshell_key, and decrypt_webshell, which handle individual steps.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The 'one-shot' phrasing and the enumerated steps give clear context that this tool is the all-in-one alternative to running separate sibling tools. It also states it accepts 'session_id or pcap_path', implying when input sources are available. However, it does not explicitly state when not to use it or mention alternative tools by name.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It discloses the brute-force method and the use of common passwords, but does not mention potential side effects like high resource usage, prolonged execution, or failure outcomes. The description adds basic behavioral context but could be more transparent.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise, with the first sentence stating the core purpose and the second sentence enumerating usage conditions. Every sentence adds value, and the formatting with numbered conditions is well-structured.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the absence of an output schema and annotations, the description does not explain return values or potential side effects. However, it clearly states the triggering scenarios and the tool's action, making it contextually adequate. It could be improved by mentioning what the tool returns on success or failure, but overall it is complete enough for an agent to decide when to invoke it.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema covers all 4 parameters with descriptions, achieving 100% coverage. The description provides no additional parameter-specific meaning beyond the schema, which is already clear. Thus, the baseline score of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description explicitly states the action: 'Brute force webshell decryption key using common passwords.' It is specific to webshell decryption and distinguishes itself from sibling tools like extract_webshell_key and decrypt_webshell by focusing on brute-forcing the key rather than extracting or using a known key.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides explicit conditions for use: '1) Key extraction failed, 2) Decryption with known key failed, 3) Need to recover key from encrypted traffic.' This clearly indicates when to use the tool versus alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure. It reveals that the tool performs live capture (as opposed to reading from a file) and focuses on TCP/UDP conversations. However, it does not disclose potential side effects (e.g., resource usage, need for root privileges, or impact on the network interface), which is a notable gap for a live capture tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise, front-loaded with the core purpose, and uses bullet-like 'Use this when' for guidelines. Every sentence adds value, and it is appropriately sized for the tool's simplicity.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description gives the tool's purpose and usage context, but with no output schema and no annotations, it doesn't fully explain what the returned 'conversation statistics' will look like or any prerequisites/assumptions. For a tool with only 3 optional parameters, this is adequate but leaves gaps in the agent's understanding of the result format.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 100% description coverage, with each parameter (duration, interface, tshark_path) already documented. The description does not add any parameter-specific meaning beyond this. According to the rubric, the baseline for high schema coverage is 3, and the description provides no additional value for parameter semantics.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's function: 'Capture live traffic and provide TCP/UDP conversation statistics.' It uses a specific verb (Capture) and resource (live traffic), and specifies the output (conversation statistics). This distinguishes it from sibling tools like capture_packets (raw capture) and get_top_talkers (top talkers), though it doesn't explicitly name them.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides explicit use cases: 'Use this when: 1) User wants conversation details, 2) Identifying communicating pairs, 3) Network mapping.' This gives clear context for when to invoke the tool. However, it doesn't mention when not to use it or explicitly name alternative tools, so it falls short of a 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure. It states that it captures live traffic and returns JSON, but does not disclose prerequisites (e.g., root/admin privileges, tshark installed), side effects (e.g., network interface impact, potential data volume), or termination behavior (e.g., duration-bound). These are significant gaps for a capture tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise, fitting in one sentence plus a short list. The Chinese prefix '【实时抓包】' is somewhat redundant but not harmful. The use-case list is efficient and front-loaded. Overall, it is well-structured and not wordy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool has 3 parameters (all documented in schema), no output schema, and no annotations. The description gives a high-level return format ('raw packet data as JSON') and use cases, but does not detail the capture lifecycle, how raw data is structured, or how this differs from run_tshark, which is a sibling. It is minimally sufficient but leaves gaps for a network operation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, since each parameter (duration, interface, tshark_path) has a description in the input schema. The description text adds little beyond the schema, only implicitly referencing duration via 'capture live traffic', so the baseline of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('Capture') and resource ('live traffic') and specifies the output format ('raw packet data as JSON'). It clearly distinguishes itself from sibling tools like list_pcaps and load_pcap, which handle existing captures, while this tool is for live capture.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly provides 'Use this when' conditions (live traffic capture, monitoring, real-time threat detection), which gives clear context for when to select the tool. It does not mention when not to use it or mention alternatives, but the stated use cases are sufficient for basic guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden of behavioral disclosure. It only states the action and output, omitting operational details like capture duration, interface requirements, potential admin privileges, or side effects. This leaves the agent unaware of the time/resource impact.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Description is two short sentences, front-loaded with the action. The Chinese '【实时抓包】' is slightly redundant with 'Capture live traffic' but not harmful. Overall efficient and easy to scan.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Description covers purpose and use cases, but lacks explanation of the output format of 'protocol hierarchy statistics' and does not mention that this is a live capture requiring network access or privileges. With no output schema and no annotations, this is a moderate gap for a simple tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, with each parameter (duration, interface, tshark_path) having a description. The tool description adds no additional parameter semantics, so the baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

Description explicitly states 'Capture live traffic and provide protocol hierarchy statistics', using specific verb 'capture' and resource 'live traffic' with a defined output. It clearly distinguishes from siblings like capture_packets and capture_conversations by focusing on protocol distribution.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Description lists three concrete when-to-use scenarios: 'User wants protocol distribution', 'Quick network overview', 'Traffic analysis summary'. It provides clear context but does not explicitly mention alternatives or when not to use.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so description carries the burden. It indicates a read-only lookup against URLhaus, but doesn't disclose response format, potential external API dependency, or edge cases like unknown IPs. Minimal behavioral disclosure.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Three sentences, front-loaded with the core action and use cases. No filler. Very efficient.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple two-parameter lookup tool, the description covers purpose and use cases. Lacks return value details, but given no output schema, this is acceptable. Sufficient for an agent to invoke correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema covers both parameters (ip and urlhaus_url) with descriptions, so baseline 3. Description adds no additional parameter context beyond what's already in the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

Clearly states it checks an IP address against URLhaus blacklist, a specific verb+resource. Differentiates from siblings like extract_iocs and advanced_threat_detection by focusing on IP reputation lookup.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly lists three use cases ('User asks if an IP is malicious', 'Checking IOCs', 'Threat intelligence lookup'). However, it doesn't mention when not to use it or alternative tools, so not a perfect 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. 'Close and clean up' hints at resource release but does not disclose whether the close is irreversible, what data is discarded, or any side effects on analysis state.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence of eight words, front-loaded with the action and object. Every word is necessary; there is no redundancy or filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with one fully documented parameter and no output schema, the description is largely complete. It identifies the operation and target, and while behavioral transparency is limited, the simplicity of the tool reduces the need for additional context.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The only parameter, 'session_id', is fully documented in the schema with a description ('ID of the session to close'). The tool description adds no additional semantic meaning beyond the schema, so baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a clear verb ('Close') and resource ('PCAP analysis session'), explicitly stating the action. It distinguishes itself from sibling analysis and capture tools by being the only session cleanup operation.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides clear context: it is for a PCAP analysis session, implying use after analysis is complete. No exclusions or alternatives are needed since no other sibling tool provides session closing.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure. It mentions 'automatically decode' but does not state whether the operation is read-only, what happens if decoding fails, whether it affects session state, or any side effects. This is a significant gap for a tool operating on network streams.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise and front-loaded with the core action. The leading '【CTF必备】' is non-essential decoration, but the overall length and structure are efficient, with clear use-case bullets following the main statement.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with no output schema and no annotations, the description provides adequate purpose and usage guidance but lacks behavioral details (error handling, output format, read-only confirmation) needed for full contextual completeness. It's minimally viable but not comprehensive.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema already provides 100% description coverage for all three parameters. The description adds limited meaning by mentioning the encoding types (base64, hex, URL, rot13), which correspond to the 'encoding' parameter, but doesn't add anything beyond the schema's existing descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's function: automatically decoding Base64, hex, URL, or rot13 encoded data. It uses a specific verb ('decode') and names the resource (encoded data streams), distinguishing it from sibling tools like follow_tcp_stream and analyze_entropy.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides explicit when-to-use scenarios (user asks to decode, after entropy analysis, found encoded flag), giving clear context. However, it lacks explicit when-not-to-use guidance or mention of alternative tools, so it's just short of a 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description discloses a key limitation (does not guarantee full TLS/CredSSP decryption) and mentions NLA/TLS detection and handshake hints. However, with no annotations, it fails to mention potential side effects, required permissions, or failure modes.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, immediately states the main function, and includes the critical caveat. No wasted words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Despite a complex 7-parameter tool with no output schema, the description omits return format, interpretation of results, and prerequisites (e.g., loaded PCAP). The description covers the basic purpose but is not sufficient for an agent to confidently invoke the tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so baseline is 3. The description adds context by indicating session_id and pcap_path are alternative sources, and that NTLM-related parameters are used for decryption correlation, adding value beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool analyzes RDP sessions and correlates them with NTLM evidence, with a specific caveat about decryption limitations. This distinguishes it from siblings like extract_ntlm_hashes and analyze_rdp_attack_chain.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this tool versus alternatives like analyze_rdp_attack_chain or extract_ntlm_hashes. The description only states inputs, not the appropriate usage context or prerequisites.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden. It discloses supported cipher types (AES, AES+XOR, XOR) and the purpose, which adds value. However, it does not state whether the operation is read-only, what happens if the key is missing or wrong, or any prerequisites like a loaded session, so transparency is incomplete.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is extremely concise, with two clear sentences. It leads with the primary purpose, lists supported variants, and then gives usage conditions. Every sentence contributes, and the structure is easy to parse.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool has 5 parameters, no output schema, and no annotations. The description explains the core purpose and when to use it, but omits details about return format, error handling (e.g., missing key), and prerequisites like session state. Given the moderate complexity, some gaps remain.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents all parameters. The description adds no extra meaning beyond mentioning the supported webshell types, which loosely relates to the tool_type parameter but does not provide additional syntax or constraints. Thus baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool decrypts webshell traffic to reveal attacker commands, naming specific webshell tools (Behinder, Godzilla, AntSword). This distinguishes it from sibling tools like detect_webshell or extract_webshell_key, which have different purposes.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicit 'Use this when' conditions (key extracted, user provides key, want to see commands) give clear context for when to invoke this tool. However, it does not explicitly mention when not to use it or point to alternatives, so it falls short of full guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden of behavioral disclosure. It only states the detection action and usage scenarios, but does not mention return format, whether an active session is required, or any side effects. This lack of detail is a significant gap.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise, consisting of two sentences: the first states the purpose and the second lists usage scenarios. It is front-loaded and every sentence earns its place with no redundant information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple tool with two parameters, the description provides a clear purpose and usage conditions, which is adequate for basic selection. However, it lacks behavioral context such as output details and prerequisites (e.g., requiring a loaded session), leaving some gaps that an agent would need to infer from sibling tools.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema descriptions cover 100% of the parameters, providing clear meaning for both threshold and session_id. The description text adds no extra semantic layer beyond what the schema already offers, so the baseline of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's function: detecting port scanning behavior from traffic patterns. It is specific to port scan, distinguishing it from broader threat detection siblings like detect_suspicious, and the usage scenarios reinforce its intended purpose.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly lists when to use the tool (suspected reconnaissance, many connections to different ports, early stage of attack analysis), which is clear usage guidance. However, it does not mention when not to use the tool or direct comparisons with alternatives, preventing a perfect score.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description must fully disclose behavioral traits, but it only mentions 'predefined rules'. It does not state whether the operation is read-only, what side effects occur, what permissions are needed, or what output is produced. This is insufficient for an agent to understand the tool's safety profile and behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, front-loaded sentence that communicates the core action and context efficiently. Every word contributes meaning, and there is no redundant or filler content, making it appropriately sized.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool has no output schema, so the description should explain what the tool returns, but it does not. It also leaves ambiguous what constitutes 'suspicious activity' and how results are presented, which is problematic given the large number of sibling tools and the need for accurate selection.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema gives 100% description coverage for both parameters (session_id and ruleset), so the baseline is 3. The description adds no extra meaning beyond the schema—it merely repeats the idea of 'predefined rules' without clarifying possible ruleset values or how they affect detection.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly identifies the verb ('Detect') and resource ('suspicious activity in the loaded PCAP'), adding 'based on predefined rules' for specificity. However, it does not distinguish from overlapping siblings like advanced_threat_detection or detect_port_scan, leaving slight ambiguity about its exact scope.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The phrase 'in the loaded PCAP' implies a prerequisite (the PCAP must be loaded via load_pcap), providing some usage context. Yet it lacks explicit recommendations on when to use this tool versus alternatives, and no exclusions or alternative names are given.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the burden. It mentions 'using fingerprint matching' and focuses on encrypted traffic, which adds some behavioral context. However, it does not disclose whether the tool is read-only, if it requires prior session setup, or what the output format is. This is a moderate gap.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise and front-loaded, with the core purpose in the first sentence followed by pragmatic usage triggers. Every sentence earns its place, and the structure is easy to scan.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no output schema and no annotations, the description is somewhat incomplete. It provides use cases but does not explain expected return values, interpretation of results, or session prerequisites. The presence of related sibling tools like load_pcap and close_session suggests a session context that could have been clarified.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% for both session_id and stream_index, so the schema fully documents the parameters. The description does not add any extra meaning about parameter usage beyond the schema, hitting the baseline of 3.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool detects encrypted webshell traffic (Behinder, Godzilla, AntSword) via fingerprint matching. The verb 'Detect' is specific and the resource is well-defined, distinguishing it from siblings like detect_port_scan or detect_suspicious.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly provides three trigger conditions: 'User asks about webshell', 'Suspicious HTTP traffic found', and 'Encrypted POST data detected.' This gives clear usage context, though it does not explicitly mention alternatives or when not to use the tool.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries full burden. It implies a read-and-write operation (exporting objects), but does not disclose side effects such as creating output files, overwriting behavior, or required permissions. There is no mention of what happens to the output directory or any processing limits, so significant behavioral traits remain opaque.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, front-loaded sentence with no fluff. It states the action, the target, and the input modes efficiently. Every word earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with 5 parameters, no output schema, and no annotations, the description covers the core purpose and input selection but lacks details about output behavior (e.g., file naming, directory creation) and edge cases. It is adequate but not fully complete given the absent structured metadata.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents all five parameters. The description adds a small insight by noting the tool accepts 'session_id or pcap_path', hinting at mutual exclusivity, but does not elaborate on format or usage. This marginal addition keeps it at the baseline for high schema coverage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('Export') and resource ('objects from a PCAP') and specifies the basis ('protocol'). It clearly distinguishes from sibling tools like extract_iocs or extract_credentials by focusing on protocol-based object export.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides clear context: export objects based on protocol and accept either session_id or pcap_path. However, it does not explicitly state when to use this tool over alternatives like extract_iocs, nor does it mention any exclusions or prerequisites. Usage is implied rather than explicitly guided.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure. It states the input source (PCAP file) and protocols, but does not explicitly mention that the operation is read-only, describe the output format, or address error handling. The purpose is clear, but behavioral details remain implicit.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences: the first states the function and protocols, the second lists usage scenarios. The Chinese prefix '【取证分析】' is concise and the text contains no redundant or vague phrasing.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool lacks an output schema and annotations, so the description should indicate return values and clarify input precedence (e.g., pcap_path vs session_id). While the core purpose and usage scenarios are covered, the omission of output format and parameter interaction leaves significant gaps for an agent attempting to invoke the tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema describes all three parameters (pcap_path, session_id, tshark_path) with meaningful descriptions, achieving 100% coverage. The description adds no supplementary parameter information beyond what the schema already provides, so the baseline score of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses the specific verb 'Extract' with a defined resource ('credentials from a PCAP file') and explicitly lists supported protocols (HTTP Basic, FTP, Telnet, Kerberos). This distinguishes it from sibling tools such as extract_ntlm_hashes or extract_iocs, which target different artifacts.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides explicit 'Use this when' conditions (finding passwords, credential harvesting analysis, forensic investigation), which clearly communicate when the tool is appropriate. It does not mention alternatives or exclusion cases, but the conditions are concrete enough to guide selection.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries full responsibility for behavioral disclosure. It does not mention whether the operation is read-only, what the output format is, any side effects, or required permissions. 'Extract' suggests non-destructive behavior but this is not confirmed, and no details about return values or limitations are given.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence that front-loads the core purpose with no wasted words. It clearly communicates the tool's function in a highly efficient manner.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the absence of annotations and output schema, the description is under-specified. It does not explain the relationship between the session_id parameter and the 'loaded PCAP', nor does it describe what the extracted IOCs look like or how filters affect the output. For a tool with potential complexity around session state and filtering, more context is needed.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema already describes both parameters with 100% coverage: 'session_id' as 'ID of the session' and 'filters' as 'Optional filters to apply'. The description adds no additional meaning about these parameters, so a baseline score of 3 is appropriate given the high schema coverage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's action ('Extract') and resource ('Indicators of Compromise (IOCs)') from a specific context ('the loaded PCAP'). This is specific and distinguishes it from sibling tools like extract_credentials or extract_ntlm_hashes, making the purpose unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The phrase 'from the loaded PCAP' implies a prerequisite (loading a PCAP first) but does not explicitly state when to choose this tool over alternatives. No exclusions or alternative tool references are provided, so guidance is implied rather than explicit.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden. It discloses input modes and output formats but does not reveal whether the operation is read-only, what the return value looks like, prerequisites like a loaded PCAP, or limitations. This is a significant gap for a tool with zero annotation coverage.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence with a concise tag prefix that immediately front-loads the purpose. Every phrase earns its place, and there is no redundant verbiage.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool has 4 parameters and no output schema, the description lacks critical contextual details such as the return format of extracted hashes, prerequisites (e.g., needing a loaded PCAP), and behavior when both session_id and pcap_path are supplied. The presence of sibling tools further underscores the need for clearer usage boundaries.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the baseline is 3. The description adds minimal value by saying 'Accepts session_id or pcap_path', slightly clarifying the alternative inputs, but the schema already documents these parameters. No additional parameter semantics are provided.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states a specific verb 'Extract' and a specific resource 'NTLM hashes from SMB/RDP authentication traffic'. It also mentions output formats (Hashcat, John), which distinguishes it from more generic tools like extract_credentials.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives context by specifying the target traffic (SMB/RDP) and input modes (session_id or pcap_path), but it does not explicitly state when to choose this tool over siblings like extract_credentials or decrypt_rdp, nor does it mention exclusions or alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It clearly states the action (extract key) and context (handshake traffic), which implies a read-only operation on network data. However, it does not explicitly disclose potential side effects, failure modes, or return structure, leaving some ambiguity for a tool without annotation support.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact and front-loaded: the first sentence states the purpose, and the second provides structured usage conditions via a numbered list. Every sentence earns its place, with no redundant information. It is an efficient, well-organized description.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the moderate complexity (4 parameters, no output schema, no annotations), the description is quite complete. It provides the purpose, likely workflow position, and conditions for use. The lack of an output schema means the description doesn't need to explain return values, though it could have mentioned how the extracted key integrates with decrypt_webshell. Overall, it is sufficient for an AI agent to select and invoke the tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema covers 100% of the parameters with descriptions, so the baseline is 3. The tool description does not add significant detail beyond the schema—it mentions 'first request' which loosely relates to stream_index, but does not clarify parameter syntax or format beyond what the schema already provides.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's function: 'Extract decryption key from webshell handshake traffic.' This uses a specific verb and resource, and it is distinct from sibling tools like detect_webshell (which detects encrypted traffic) and decrypt_webshell (which presumably uses the key). The Chinese prefix '【Webshell专用】' further emphasizes its specialized scope.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides explicit when-to-use guidance with a numbered list: after detect_webshell finds encrypted traffic, when the user knows the webshell type, or when a potential key exchange is found. This clearly distinguishes it from alternatives and outlines the correct sequence in a workflow.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description must disclose behavioral traits. It only states the core action and does not reveal any side effects, limitations, or operational details (e.g., whether it requires an active session or what output format to expect). This is a significant gap for a tool with no annotation support.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, concise sentence that is front-loaded with the action. It is appropriately sized for a simple tool and avoids unnecessary verbosity, though it lacks any elaboration that could enhance its usefulness.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool has no output schema and no annotations, and the description only gives a high-level action. It does not explain what 'follow' entails, what the output looks like, or any operational context. Given the tool's complexity and the absence of structured metadata, this is incomplete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema already describes all three parameters with complete descriptions (100% coverage), so the description does not need to add more. It adds no parameter-specific info, but the baseline of 3 is appropriate given the schema thoroughly covers the semantics.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description 'Follow and extract the content of a TCP stream' clearly states the tool's action and resource. It is specific and understandable, but it does not differentiate from sibling tools like decode_stream or run_tshark, so it falls short of a 5.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides no guidance on when to use this tool versus its alternatives, nor does it mention any prerequisites such as needing an active session. It is a bare statement with no contextual direction.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure. It only states the basic action and the prerequisite of a loaded PCAP, but does not disclose output format, potential side effects, error behavior, or any other behavioral traits beyond what the name implies.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single concise sentence that front-loads the core action and object. Every word contributes; there is no redundancy or filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with two parameters and no output schema, the description is minimal but somewhat adequate. It fails to explain the output format or provide usage context, but the name and description give a basic understanding. The lack of any behavioral or return-value detail leaves gaps.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% (both session_id and interval_seconds have descriptions), so the schema already documents parameter semantics. The tool description does not add any additional parameter meaning, meriting the baseline score of 3.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action ('Generate') and the resource ('a timeline of network events from the loaded PCAP'), making its purpose understandable. However, it does not differentiate from similar timing/analysis tools in the sibling list like 'analyze_timing' or 'summary_stats'.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides no guidance on when to use this tool versus alternatives, nor any exclusions or prerequisites beyond the implicit 'loaded PCAP' context. There is no mention of scenario fit or comparison with sibling tools.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description must carry the burden of behavioral disclosure. The verb 'Get' implies a read-only operation, but it does not explicitly state whether it modifies state, requires an active session, or what the return format is. It provides some context about sorting by traffic volume but lacks detail.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise and front-loaded: one sentence for purpose and a short bulleted list of use cases. Every word earns its place, with no redundant information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple get tool with no output schema, the description covers the core purpose and common use cases. However, it does not describe the output structure (e.g., list of pairs with metrics) or any prerequisites beyond the session_id parameter.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, with all three parameters documented. The description adds no extra meaning about parameters, leaving the schema to carry the full burden. This meets the baseline of 3 for high schema coverage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool does 'Get Top-N communicating pairs by traffic volume', which is a specific verb+resource+scope. It distinguishes from siblings like summary_stats and capture_conversations by focusing on ranking pairs by volume.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides explicit when-to-use scenarios: user wants to see who talks most, identifying C2 servers, finding data exfiltration targets. However, it does not mention when not to use it or name alternative tools, so it lacks exclusions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden. It only says 'List' and does not disclose return format, ordering, error handling, or whether it is a safe read-only operation. The behavior is implied but not detailed.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, front-loaded sentence with no redundant information. Every word contributes to the tool's purpose.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

There is no output schema or annotations, and the description does not explain what the return value looks like or any edge-case behavior. It is minimally viable but lacks important context for an agent to fully anticipate results.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema provides 100% description coverage for both parameters (recursive and directory_path), so the baseline applies. The tool description adds no parameter-specific meaning beyond what the schema already provides.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb 'List' and the resource 'PCAP files in the specified directory,' which distinguishes it from sibling tools like load_pcap or capture_packets. It is specific and unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage for inspecting available PCAP files in a directory but does not explicitly state when to use this tool versus alternatives or provide any exclusions. Context is clear but guidance is minimal.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden of behavioral disclosure. It only mentions the return of a session ID but fails to disclose potential side effects, resource usage, session lifecycle, or error handling. It does not mention how max_packets affects loading or whether the file is fully read into memory.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, direct sentence with no unnecessary words. It is efficiently front-loaded with the primary action and outcome, making it easy to parse. Every word earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool that initializes session state, the description is too sparse. It doesn't explain that the returned session ID is required by sibling analysis tools, how max_packets affects the loaded data, or what happens if the file is invalid. Given there is no output schema, more context is necessary for an agent to use this tool effectively.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The description does not mention parameters; however, the input schema fully describes both pcap_path and max_packets (including their descriptions and defaults). Since schema coverage is 100%, the description adds no additional parameter context beyond what the schema already provides, matching the baseline of 3.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool loads a PCAP file and returns a session ID, with a specific verb ('Load') and resource ('PCAP file'). It distinguishes itself from sibling tools like list_pcaps or capture_packets by its loading action and explicit outcome of a session ID.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is given on when to use this tool versus alternatives, nor any prerequisites or follow-up steps. The phrase 'for analysis' hints at its role but doesn't explicitly mention that the returned session ID is needed by other analysis tools or that this is the entry point for PCAP processing.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description must bear the full burden. It discloses the outputs and input types, but does not mention whether the operation is read-only, whether it creates a session when pcap_path is used, or any limitations on processing (e.g., max_packets is in the schema but not described as a bound in the description). Some behavioral context is present, but not as rich as a mutation tool with no annotations would need.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is exactly two sentences, front-loading the action and expected outputs in the first sentence and clarifying input modes in the second. There is no redundant information or filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description, combined with the fully-documented six-parameter schema, gives enough to invoke the tool correctly: choose session_id or pcap_path, and optionally tune top_n, max_packets, include_iocs, and include_webshell_hint. The lack of an output schema is partially offset by listing the main output categories, though it does not detail what 'recommended next analysis tracks' would look like.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3. The description adds important semantic value by stating 'Accepts session_id or pcap_path', clarifying that these are alternative ways to provide input. This goes beyond the schema, which merely lists both as optional without explaining their relationship.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb ('triage') and resource ('PCAP') and enumerates concrete outputs: protocol overview, top talkers, IOC hints, and recommended next analysis tracks. This clearly distinguishes it from sibling tools that focus on one specific analysis, such as get_top_talkers or detect_port_scan.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The phrase 'One-shot triage' implies it is an initial overview tool, and the mention of 'recommended next analysis tracks' suggests a starting point. However, there is no explicit guidance on when to use this versus alternatives like summary_stats or get_top_talkers, nor any exclusions or alternative tool recommendations.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries full responsibility for behavioral disclosure. It states the core read operation (apply filter, return packets) but does not mention whether it modifies the session, requires an already-loaded PCAP, or how errors or limits are handled.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, front-loaded sentence that directly states the action and outcome. No unnecessary words or repetition, making it optimally concise.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool is relatively simple, but the description omits important context such as the requirement that a PCAP must already be loaded via a session, the meaning of the 'limit' parameter, and return format details. Since there is no output schema, the description should provide more context to be fully actionable.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema provides complete descriptions for all three parameters (session_id, filter, limit), so schema coverage is 100%. The description itself adds little beyond the schema, only implying that 'filter' refers to a display filter expression, which is already stated in the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool applies a display filter to the loaded PCAP and returns matching packets. It uses a specific verb ('apply') and resource ('display filter to loaded PCAP'), which distinguishes it from other tools that run tshark or search patterns, though it does not explicitly name alternatives.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives no guidance on when to use this tool versus siblings like run_tshark or search_patterns. It implies it operates on a loaded PCAP but does not state prerequisites, exclusions, or alternative scenarios.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden. It discloses that arguments are validated against a whitelist, which is useful safety context, but it does not explain the nature of the whitelist, failure behavior, output format, or any side effects. The behavioral disclosure is minimal.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is extremely concise: two sentences with no wasted words. The whitelist sentence is valuable and earns its place, and the overall structure is front-loaded and clear.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Despite having a clear schema, the tool lacks annotations and an output schema. The description is underspecified: it does not explain the whitelist contents, edge cases, security implications, or typical usage scenarios. For a general command execution tool, this is a significant gap.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 100% description coverage for all three parameters, so the baseline is 3. The description adds no extra meaning beyond what the schema already provides; it merely restates that arguments are passed to tshark.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it runs a tshark command with specified arguments, using a specific verb and resource. It adds a key qualifier about whitelist validation, but does not differentiate it from sibling tools like run_display_filter or capture_packets, which are more specialized.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is provided on when to use this tool versus the many specialized sibling tools. There are no examples, exclusions, or alternative suggestions, so an agent might not know if this is the right choice for a given analysis task.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It implies a read-only search operation and mentions data sources and optional stream index, but does not disclose potential side effects, limitations, or behavior on no matches. This is adequate but not rich.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact, front-loaded with the main purpose, and uses a clear list for usage scenarios. Every sentence contributes value without unnecessary detail.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description adequately covers purpose, usage context, and key parameters. However, with no output schema, it does not mention return format or behavior when no matches are found, which would be useful for a search tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% and all parameters already have descriptions. The description adds some contextual meaning (e.g., linking custom regex and CTF flags to specific parameters) but does not significantly enhance understanding beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it searches for patterns including CTF flags and custom regex, with a specific verb ('search') and resource ('patterns'). It also lists explicit use cases, distinguishing it from sibling tools by focusing on pattern searching rather than detection or extraction.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides three explicit 'when to use' scenarios: finding flags, searching specific patterns, and searching after following a TCP stream. This gives clear context for usage, though it does not mention when not to use or explicitly name alternative tools.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure. It does state the main behavior (solve the CTF, extract artifacts, compute a flag) and the accepted inputs, but it does not disclose potential side effects, failure modes, or whether it requires a pre-loaded PCAP context. It is adequate but not deeply transparent.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, dense sentence that front-loads the tool's purpose and enumerates all artifacts and inputs without wasted words. Every phrase contributes meaningful information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity and lack of an output schema, the description covers the main return values by listing the extracted fields and the computed flag. It could be more complete by stating that at least one of session_id or pcap_path should be provided, but overall it gives a strong picture of what the tool produces and how to invoke it.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema already describes all three parameters (100% coverage), so the baseline is 3. The description adds meaning by clarifying that session_id and pcap_path are alternative input sources ('Accepts session_id or pcap_path'), which is not explicitly stated in the schema. This lifts it above baseline, though max_packets is not mentioned in the description.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('Solve') and a clear resource ('the Solar traffic-analysis CTF task'), then enumerates the exact expected outputs (CVE, forged username, filename, run path, flag, JWT key, final flag). This clearly distinguishes it from sibling analysis tools, which focus on individual detection or extraction steps.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives clear invocation context by stating it accepts either a session_id or pcap_path, which is essential usage guidance. However, it does not explicitly mention when to prefer this over the many sibling analysis tools, nor does it provide any exclusions or prerequisites beyond the accepted inputs.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description must carry the full burden. It indicates a read-only operation via 'Get' and a prerequisite of a loaded session, but it does not disclose what statistics are returned, error handling, or performance implications. This is minimal disclosure for an unannotated tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, front-loaded sentence with no wasted words. It conveys the action, resource, and context efficiently, earning a perfect score for conciseness.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With one fully-documented parameter and no output schema, the description adequately states the action and prerequisite. However, it omits what 'summary statistics' actually include, which could be important for distinguishing this tool from the many sibling analytics tools.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The only parameter, session_id, is fully described in the schema as 'ID of the session', giving 100% coverage. The description adds no extra parameter-level meaning, so the baseline score of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('Get') and resource ('summary statistics') with scope ('for a loaded PCAP session'), clearly stating the tool's function. It does not explicitly distinguish it from siblings like capture_summary, but the loaded-session context provides partial differentiation.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The phrase 'for a loaded PCAP session' implies the tool should be used after a PCAP is loaded, giving some usage context. However, it does not explicitly compare with alternatives or state when not to use it, such as when a live capture is active.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.