get_failed_logins

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full disclosure burden. It reveals key behavioral traits: read-only operation, exclusion of Boot records, use of lastb with fallback to journalctl, default entry count, and non-fatal errors. While it doesn't mention auth requirements or response format details, the disclosure is strong for a simple read-only tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is extremely concise—three sentences total—yet packs in purpose, exclusions, read-only nature, fallback mechanism, default, error handling, and usage guidance. Every sentence earns its place with no redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers the core aspects: what the tool returns, what it excludes, how it acquires data, error behavior, and when to use it vs. an alternative. Given the simple one-parameter schema and presence of an output schema, this is quite complete. Minor omission is lack of detail about 'summary statistics', but that is likely covered by the output schema.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% for the single parameter 'lines', which already describes its purpose and default. The description adds minimal new meaning beyond confirming the default ('Default 20 entries') and hinting at the parameter via 'lastb -n N'. This is sufficient given the schema's clarity.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('Returns') and clearly identifies the resource ('recent failed login attempts') with a scope qualifier ('excluding Boot records'). It also explicitly distinguishes itself from a sibling tool ('get_audit_logs for kernel and auditd events'), so purpose clarity is excellent.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly states when to use this tool ('Use for security triage') and names the alternative for other use cases ('get_audit_logs for kernel and auditd events'). It also provides context about the read-only nature and fallback behavior, giving clear guidance on expected behavior.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.