threat_rules__rule_stats

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full behavioral burden. It discloses the grouping dimensions (category and source, ATR vs GuardBee) but never states that this is a read-only operation, that it reports on already-loaded rules only, or how the lane filter changes the counts.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

A single front-loaded sentence with no filler — the key resource and grouping axes come first. Its brevity is appropriate in form, though the space saved is information an agent actually needs.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no annotations, no output schema, and an undocumented enum parameter, the definition leaves critical gaps: what lane means, whether the counter reflects loaded rules only, and whether the call is safe/read-only. Only the aggregate purpose is conveyed.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The single parameter (lane, an enum of enforce/alert/hunt) has 0% schema description coverage and is never mentioned in the description. "By category and source" describes output grouping, not the lane input, so the description adds no meaning to the one parameter an agent must reason about.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description gives a specific verb ("Summarize") and a specific resource ("loaded rule counts by category and source"), which clearly distinguishes it from siblings like threat_rules__list_rules or evaluate_text. It stops short of naming those siblings or stating the scope boundary explicitly, but the purpose is unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no when-to-use guidance at all: no statement of when an agent should call rule_stats rather than list_rules or framework_map, and no mention of prerequisites or the effect of the lane filter on results. The agent must infer usage entirely.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.