Evaluates structured ATR AgentEvent JSON against security threat rules to detect risks across enforce, alert, or hunt lanes, returning text, JSON, or SARIF.
Evaluate a structured ATR AgentEvent JSON (type, content, fields, sessionId, …).
| Name | Required | Description | Default |
|---|---|---|---|
| lane | No | ||
| event | Yes | JSON AgentEvent: { type, content, fields?, sessionId?, agentId?, scanContext? } | |
| format | No |
Changes observed during successful MCP inspections.
v0.1.1Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full behavioral burden and largely fails. It never explains what happens to the event (blocked, logged, alerted) for each lane value, whether an 'enforce' lane can cause side effects, or what the returned evaluation looks like — the enforce/alert/hunt semantics are especially consequential and go undisclosed.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single tight sentence with the input contract front-loaded and no filler. It is efficient, though it is efficient at saying too little rather than at communicating the essentials.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no annotations, no output schema, 33% schema coverage, and two undescribed enum parameters, this definition is not complete enough for an agent to invoke the tool confidently. It documents the input envelope but leaves the evaluation output, lane semantics, and format behavior entirely unaddressed.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is only 33%: only 'event' is documented in the schema, and 'lane' and 'format' are bare enums. The description lists event sub-fields (type, content, fields, sessionId) but adds nothing about their expected values or shapes, and says nothing at all about the lane's behavioral meaning or the format options.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a specific verb ('Evaluate') and a specific resource ('ATR AgentEvent JSON'), and the word 'structured' distinguishes it from the sibling evaluate_text and evaluate_file tools, which take raw text or files. It does not, however, state what the evaluation produces (findings, verdict, severity), leaving the outcome implicit.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No when-to-use guidance is given at all. With three closely named siblings (evaluate_text, evaluate_file, list_rules), the description never says when an agent should choose this event-based path over the text or file variants, nor does it mention prerequisites.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.