Import SARIF

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations indicate the tool is not read-only, not destructive, not idempotent, and not open-world. The description adds to this by specifying that it copies and parses a file, which implies a write operation (creation of parsed data). The security note about untrusted messages is a key behavioral trait beyond what annotations provide. However, it does not mention error handling, size limits, or whether the file is deleted after copying.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, well-structured sentence that conveys the core purpose and a critical security note. Every word adds value, and there is no unnecessary repetition or filler. Front-loaded with the action and resource.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool is simple with two parameters and an output schema, so the description does not need to explain return values. However, the description lacks parameter explanations and does not clarify the outcome of the import (e.g., whether it creates a case or updates state). The security note is helpful, but overall the description is too sparse to fully guide an agent that has no other context.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate for missing parameter explanations. The description does not mention either parameter (case_id or path) or their roles. The term 'configured import root' hints at path context, but the agent is left guessing what case_id means and how the path should be specified. This is a significant gap for a tool with only two parameters.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description explicitly states the action ('Copy and parse'), the resource ('a bounded SARIF 2.1.0 file'), and the source ('from a configured import root'). It also includes a security note that distinguishes it from tools that might interpret scanner messages. The purpose is distinct from all sibling tools, which are either vulnerability management or case research utilities.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies the tool should be used to import SARIF files, but it does not provide explicit guidance on when to use it versus alternatives, nor does it state when not to use it. Among siblings, there is no other import tool, so the context is somewhat obvious, but the description could still benefit from a brief 'Use this to import static analysis results in SARIF format' clarification.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.