Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Since there are no annotations, the description carries the burden of behavioral disclosure. It explicitly states that an absent frame returns found=false rather than an errorholics, which is an important non-obvious behavior. It also summarizes the return shape, though it does not mention side effects or error cases for invalid capture_id.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The opening sentence is direct and front-loaded, followed by a compact Args/Returns breakdown. Every sentence earns its place: frame-number semantics, discovery guidance, absent-frame behavior, and return summary. No filler or repetition.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool has only two required parametersholics, and both are given enough explanatory detail for correct invocation. The description also disambiguates the found=false case and summarizes the return structure. It does not detail invalid-input error behavior, but that is a minor gap given the output schema and simplicity of the call.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema only provides names and types, so all semantic weight falls on the description. It adds meaningfully by defining capture_id as 'ID of a currently loaded capture' and packet_number as 'Positive, one-based Wireshark frame number.' This is exactly the additional information an agent needs to construct valid arguments.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific action and resource: 'Return the decoded protocol layers and fields for one frame.' It clearly conveys the core purpose. It does not explicitly differentiate from the similarly named sibling get_packet_by_number, but the emphasis on decoded layers implies that distinction.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides helpful usage context: it explains the one-based Wireshark numbering and suggests using filter_packets or validation frames to discover relevant numbers. However, it does not explicitly say when to prefer dissect_packet over sibling tools like get_packet_by_number, nor does it state any exclusions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description fully carries the behavioral disclosure burden. It explains the temporary-file workflow, the guarantee that the source capture is never overwritten, and that configured decryption keys are applied during filtering, all of which are non-obvious and valuable safety semantics.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured and front-loaded: one sentence states the core purpose, a short paragraph conveys critical behavior, then a concise Args section documents parameters. Every sentence adds necessary information without redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with no input schema descriptions and no annotations, the description covers purpose, parameter constraints, behavioral guarantees, and the return value content. Nothing needed for an agent to select and invoke the tool correctly is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate. It provides meaningful semantics for all four parameters, including constraints on capture_id being currently loaded, filter_expression being non-empty, output_path requiring a .pcap/.pcapng suffix with an existing writable parent directory, and overwrite defaulting to false.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'Write packets matching a display filter to a new capture file.' This clearly identifies the tool's function and distinguishes it from sibling in-memory filtering tools like filter_packets or metadata viewers.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description clearly frames the tool as an export-to-file operation and provides practical context such as destination format and overwrite behavior. It does not explicitly name alternatives or state when not to use this tool, but the usage context is strongly implied and unambiguous.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure. It explains that results are summaries, that a normalized filter and match count are returned, and that full dissection requires dissect_packet. It could additionally state explicitly that this operation is read-only, but the filter/find framing and returned summary format make the behavior reasonably clear.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is organized with a clear opening sentence, useful filter examples, an alternatives note, and structured Args/Returns sections. Every part earns its place; the examples are illustrative rather than padding, and the alternative tool reference is front-loaded before parameter details.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool has only three simple parameters and an output schema, and the description covers the filter syntax, parameter constraints, return contents, and relationship to dissect_packet. An agent has everything needed to invoke the tool correctly and interpret its results.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must fully explain parameters, and it does. capture_id is defined as a currently loaded capture, filter_expression is specified as a non-empty Wireshark display filter, and limit is constrained to 1-1000 with a default of 100. This leaves no ambiguity about how to fill the arguments.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource: 'Find packets using a Wireshark/TShark display-filter expression.' It also distinguishes itself from dissect_packet by clarifying that it returns summaries rather than complete field trees. This gives an agent a clear, non-tautological purpose and differentiates it from sibling tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives concrete usage context, including examples of valid display filters and an explicit warning that the expression is not a BPF/libpcap capture filter. It also tells the agent when to use dissect_packet instead, which is strong guidance for selecting among siblings.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden and delivers: it discloses the query mechanism (decoded wlan.bssid field), MAC-input normalization behavior (hyphenated and colon-separated formats accepted), and the return contract including a truncation flag. It doesn't explicitly address side effects or error conditions beyond the field requirement, but for a retrieval tool this is strong coverage.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The purpose is front-loaded in the first sentence, followed by one tight technical note and clean Args/Returns sections that are easy to scan. Every sentence earns its place — there is no filler, repetition, or overloaded prose.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 3-parameter retrieval tool with zero annotations and zero schema descriptions, this is complete: it covers purpose, prerequisites, full parameter semantics, and the return contract. Since an output schema exists, the Returns section is bonus value, not a gap-filler.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description fully compensates. Each parameter gains real meaning: capture_id is 'ID of a currently loaded capture,' bssid gets a concrete MAC format example (aa:bb:cc:dd:ee:ff), and limit gets an explicit valid range of 1 through 1000. This goes well beyond the bare name/type pairs in the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The opening sentence states the specific action: 'Retrieve IEEE 802.11 packets associated with an access-point BSSID' — a concrete verb, resource, and scope. The AP-BSSID framing clearly distinguishes it from siblings like get_client_packets, get_flow_packets, and get_related_packets.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives an explicit, actionable precondition: the query decodes the wlan.bssid field and therefore requires an IEEE 802.11 capture containing that field, which tells the agent when this tool will fail. It doesn't name alternative tools for non-AP packet queries, but the context is clear enough to route correctly.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full behavioral burden. It discloses that interface fields depend on what the capture writer recorded, and the Args section notes the capture must be currently loaded. The return list (interface count, names, link types, snap lengths, timestamp precision, OS, packet counts) hints at read-only behavior. This is more transparent than many tools with zero annotations, though it doesn't mention error cases or side effects beyond the implicit read.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact and well-organized. The purpose is front-loaded in the first sentence, followed by the relationship to get_capture_metadata, then a short Args/Returns breakdown. No filler or redundant text; every sentence earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with a single required parameter and no annotations, the description is complete. It covers the purpose, the behavioral caveat about field dependence, the loaded-capture prerequisite, and the return contents. It also distinguishes itself from a key sibling. There is nothing an agent needs to invoke it correctly that is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate. It does so for the only parameter by adding 'ID of a currently loaded capture,' which specifies a prerequisite and clarifies the expected input beyond the bare 'Capture Id' in the schema. This is meaningful additional semantics that helps an agent understand what value to supply.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description starts with a clear verb and resource: 'List capture interfaces or radio adapters stored in the file.' It then explicitly frames itself as a focused view of get_capture_metadata for multi-interface PCAPNG files, which differentiates it from that sibling and makes its purpose unmistakable. No ambiguity about what the tool does.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides usage context by stating it is 'a focused view of get_capture_metadata for multi-interface PCAPNG files,' implying that for multi-interface files this tool is more targeted than the broader metadata call. It does not explicitly list when-not-to-use alternatives, but the reference to get_capture_metadata and the multi-interface condition give enough context for an agent to choose correctly in most scenarios.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden for behavioral disclosure. It discloses that the result comes primarily from Capinfos, implying a standard tool output, and notes that it does not return packet dissections, which is a key behavioral trait. It also implies that metadata is returned 'when available', setting expectations for partial results. However, it does not mention any side effects (likely none since read-only), or the exact format of the returns, but given the tool is read-only and the output schema exists, this is sufficient.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with a clear main sentence, a 'Use this for' clause that lists use cases, a note on limitations, and then structured Args and Returns sections. It is front-loaded with the main purpose. The length is appropriate for the complexity. Minor redundancy exists ('Returns:' section repeats some information from the use-list), but overall it is concise and organized.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool has a single parameter, a complex use case (metadata inspection), and an output schema (which likely describes the structure of returned metadata), the description is mostly complete. It covers the primary use cases, the limitation, and parameter semantics. The absence of mention of error conditions (e.g., if capture_id is not found) is a minor gap, but the output schema and the tool's likely behavior as an inspect operation mitigate this. Overall, it is sufficient for an agent to use effectively.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%, so the description must compensate. The description explains that 'capture_id' is the ID of a currently loaded capture, which adds critical context about the parameter's meaning and prerequisite (must be loaded). This goes beyond the schema's bare 'string' type. The description also explains what the parameter is used for (identifying which capture to inspect). This is strong compensation for the lack of schema documentation.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool inspects PCAP/PCAPNG container and capture-interface metadata, listing specific aspects like file format, encapsulation, snap length, timestamp precision, capture origin, comments, time range, and per-interface information. It also explicitly notes that it does not return packet dissections, distinguishing it from dissection tools. This is a specific verb-resource combination that effectively differentiates it from siblings like dissect_packet or get_packet_by_number.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage for metadata-related inquiries about a capture (e.g., file format, timing, interfaces) and states that it does not do packet dissections, which helps with when-not-to-use. It does not explicitly name alternative tools for when packet dissections are needed, but the exclusion is clear. Given the context, this is adequate but could be improved by explicitly pointing to dissect_packet for packet-level analysis.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the burden of explaining behavior. It discloses the computation method (Capinfos totals plus TShark pass), the loaded-capture precondition, and the return contents. It does not explicitly state that the operation is read-only, but 'calculate' and 'assess' strongly imply no mutation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact, front-loaded with the main purpose, and every sentence contributes useful context. The Args and Returns sections are clean and avoid redundancy with the schema.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a single-parameter read-only statistics tool, the description covers the purpose, method, precondition, and return values. It does not discuss error conditions or performance implications of the TShark pass, but these are not critical for correct invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema provides only a bare 'capture_id' string, but the description adds meaning by stating it must be the ID of a currently loaded capture. This is the key semantic needed to call the tool correctly.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool computes aggregate traffic rates and packet-size statistics, with a specific verb and resource. It does not explicitly differentiate from sibling tools like get_summary or get_capture_metadata, though the aggregate/statistics focus helps.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

It provides explicit context for when to use it: to assess capture volume, duration, average traffic rate, and packet-size metrics. It also notes the prerequisite that the capture must be currently loaded, but does not mention alternatives or when not to use it.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full behavioral disclosure burden. It states that every packet is assigned to one evenly sized time bucket and describes the return structure. It also notes the prerequisite that capture_id must refer to a currently loaded capture. While it does not explicitly say 'read-only', the 'get' prefix and computational framing make the non-mutating behavior reasonably clear.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact and well-organized: a one-sentence purpose, a one-sentence usage rationale, a terse Args block, and a Returns block. It is front-loaded with the primary action and contains no filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with 2 parameters and an output schema, the description covers the essential invocation details: purpose, usage, parameter semantics, and the high-level return shape. It does not elaborate on error cases or edge behaviors, but the existing coverage plus the output schema makes it sufficiently complete for correct use.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description's Args section is essential and fully compensates. It explains that capture_id is the ID of a currently loaded capture and that bucket_count ranges from 1 through 100 with a default of 20, providing meaning and constraints beyond the bare schema types.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('Divide') and clearly identifies the resource ('capture time range') and output ('packet and byte-count buckets'). The purpose is distinct from sibling tools like get_capture_metadata or get_packet_timeline because it explicitly describes bucketing behavior, not just listing or summarizing.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives explicit use cases: 'Use this to locate bursts, quiet intervals, or the portion of a capture worth filtering in more detail.' This provides clear context for when to use the tool, though it does not name alternative tools or state when not to use it, which would push it to a 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description must carry the behavioral burden. It explains the query mechanism (wlan.addr), MAC normalization, and the input format, which is useful. However, it doesn't disclose potential rate limits, authorization requirements, or the behavior when no packets are found. The return structure is listed but not elaborated.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise and well-structured, with the main purpose in the first sentence, followed by technical details, then parameter documentation, and a clear return summary. Every sentence contributes value without redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given an output schema exists, the return values are partially explained in the description. The tool has moderate complexity with 3 parameters, and the description covers all parameters and the return format. Missing details on edge cases or error handling are minor given the output schema presence.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%, so the description must compensate. It explains that 'client_mac' accepts hyphenated and colon-separated formats, provides an example, and describes the 'limit' range. 'capture_id' is described as an ID of a loaded capture. This adds significant meaning beyond the schema's bare property names.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool retrieves IEEE 802.11 packets involving a Wi-Fi client MAC address, using the wlan.addr field. It distinguishes from siblings like get_ap_packets by focusing on client MAC, though it doesn't explicitly name that sibling. The purpose is specific and actionable.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage: it's for retrieving packets by client MAC, which is clear. However, it doesn't explicitly mention when not to use it or compare to alternatives like get_flow_packets or get_related_packets. The intended context is implied but not fully explicit.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are supplied, so the description carries the behavioral disclosure burden. It discloses the return contract (normalized flow type and ID, generated display filter, packet count, truncation flag, packet summaries) and the special TLS/HTTP matching rule. The verb 'Retrieve' implies read-only behavior, though the description does not explicitly state the absence of side effects.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact and logically organized: a clear lead sentence, a short context paragraph for flow ID semantics, then Args and Returns sections. Every sentence contributes useful information with no filler or restatement of the schema.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a retrieval tool with no annotations and a bare schema, the definition covers parameter semantics, valid values, constraints, return fields, and an important edge case for TLS/HTTP flows. It omits explicit guidance about when to prefer sibling tools, but that gap is minor given the clarity of the primary purpose and contract.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, and the Args section fully compensates: capture_id is defined as a currently loaded capture, flow_type lists all valid values, flow_id is explained as a non-negative TShark stream identifier, and limit is given a 1-1000 range. This adds meaning well beyond the bare schema, especially the flow-ID-versus-port distinction.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The opening sentence names the exact action and resource: 'Retrieve packets belonging to a decoded transport or application flow.' It further clarifies that flow IDs are TShark stream identifiers, not port numbers, and enumerates supported flow types, which separates it from general packet-retrieval siblings.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives clear operational context: valid flow types are listed, limit is bounded, and TLS/HTTP flows require the selected application protocol to be present on the packet. However, it never explicitly tells an agent when to choose this tool over siblings such as filter_packets, get_packets_by_time_range, or get_related_packets; the intended usage is implied rather than stated.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden. It discloses that the tool fully decodes the packet, that frame numbers are one-based, and that an absent frame returns found=false instead of raising an error. It also lists the return fields. This is solid behavioral disclosure, though it doesn't mention performance implications or whether the capture must be loaded (though capture_id implies it).

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured and efficient: a one-sentence purpose, a clarifying alias note, a behavior note, and a compact Args/Returns section. Every sentence earns its place, and the key differentiator (alias of dissect_packet) is front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool has an output schema, so return values are already structured. The description adds the found=false behavior, one-based numbering, and the alias relationship, which are the key contextual details an agent needs. It doesn't mention prerequisites like 'capture must be loaded', but the capture_id parameter and sibling load_capture make that inferable. Overall, quite complete for a lookup tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate. It does: it explains capture_id is 'ID of a currently loaded capture' and packet_number is a 'Positive frame.number value'. This adds meaning beyond the bare schema types (string/integer). It could go further by noting the range or format of capture_id, but it covers the essentials.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb ('Retrieve and fully decode') and resource ('one packet by its Wireshark frame number'), and explicitly distinguishes itself as a 'lookup-oriented alias of dissect_packet'. This makes the tool's purpose unambiguous and differentiates it from the sibling dissect_packet.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description clearly indicates this is a lookup-oriented alias of dissect_packet, implying when to use it (direct frame-number lookup) versus the alternative. It also explains the absent-frame behavior (returns found=false instead of raising an error), which is useful usage context. However, it doesn't explicitly state when NOT to use it or name other alternatives like get_packets_between_frames.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden and does so well: inclusive boundaries, compact-summary output, limit cap (1-1000), and a returned truncation flag. This goes well beyond the tool name and clearly conveys the read-oriented, non-dissecting behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact and well structured: a one-sentence purpose, a behavioral note, then Args and Returns lists. No fluff, and every sentence adds useful information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 4-parameter retrieval tool with an output schema and no annotations, the description is complete: it covers all parameters, the inclusive behavior, the compact-summary rationale, the truncation flag, and the returned fields. An agent has enough information to invoke this correctly and interpret where fine-grained dissection should happen next.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must define every parameter itself. It does: capture_id as a currently loaded capture, start/end as inclusive frame numbers, and limit with a 1-1000 range, adding real semantics the schema's type/title fields do not provide.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb-resource-scope statement: 'Retrieve packets in an inclusive Wireshark frame-number range.' It further clarifies it returns compact packet summaries rather than full dissections, which separates it from dissection-oriented siblings without decoding every field.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives clear context on when this tool is useful: to retrieve an inclusive range and get compact summaries so a caller can then select frames for detailed dissection. It does not explicitly name alternatives or state when not to use it, so it stops short of the strongest possible guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure, and it does so thoroughly. It reveals that timestamps are Unix epoch seconds matching Wireshark's frame.time_epoch, that the range is inclusive, that results are summaries rather than full packet data, and that a truncation flag may indicate limited results. This goes well beyond a simple 'retrieve packets' statement.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with a clear opening sentence, a useful Wireshark compatibility note, an alternative-tool pointer, and a compact Args/Returns layout. Every sentence contributes either semantic precision or invocation guidance; there is no filler or repetition of schema defaults.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the lack of annotations and the 0% schema description coverage, the description provides all necessary context: parameter meanings, time units, inclusivity, return summary contents, and the alternative to use for full packet dissection. An output schema exists, so the prose return description is sufficient. The tool can be selected and invoked correctly based solely on this description.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate, and it does. It explains capture_id as a currently loaded capture, start_time and end_time as inclusive Unix epoch times, and limit with a 1–1000 range. These semantics are not present in the input schema, making the description essential for correct invocation.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'Retrieve packets whose Unix timestamps fall within an inclusive range.' It clearly distinguishes itself from related tools by scoping to time-based retrieval and explicitly contrasts with dissect_packet for full decoded fields. The purpose is immediately understandable.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description states when to use the tool (time-range packet retrieval) and provides an explicit alternative: 'call dissect_packet when full decoded fields are required for an individual frame.' This gives the agent a clear decision rule for choosing between this tool and its closest alternative.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full behavioral disclosure burden. It explains the display-filter distinction, the presence of deltas and elapsed time, and the truncation status in the return, giving useful beyond-schema insight. It doesn't mention potential errors or permission requirements, but for a read-only timeline tool this is adequate.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with a summary line, a clarifying paragraph, and labeled Args/Returns sections. Each sentence adds value, though the 'making exchanges easier to inspect' clause is somewhat subjective and could be trimmed without losing information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers the tool's purpose, behavioral distinctives, all parameters, and the return shape including truncation status. Since an output schema exists, detailed return structure is a bonus. It implies the capture must be loaded, which is sufficient for an agent to sequence load_capture before this tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%, so the description must compensate and does. The Args section adds meaningful semantics for all three parameters, especially the critical note that filter_expression is a Wireshark display filter rather than a capture filter. It could detail format or defaults, but the provided definitions are sufficient for correct invocation.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Generate a chronological timeline of packet events') and clearly distinguishes itself from sibling packet-listing tools by highlighting the unique delta and elapsed-time features. An agent can immediately understand what this tool produces and how it differs from getting raw packet lists.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides clear context for when to use the tool: when a chronological, delta-based timeline is needed for inspecting exchanges. It clarifies the filter type (display vs capture) but does not explicitly name alternative tools or state exclusion conditions, stopping short of a full 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden. It discloses key behaviors: endpoint-based results are marked as heuristic and bounded by time, and it mentions the return includes a truncation flag and confidence. This goes beyond just saying 'returns related packets' and helps the agent understand the nature of the results (heuristic vs. exact). It doesn't mention any side effects (it's read-only), but that's implicit from the verb 'find.'

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with clear sections for Args and Returns. It is concise but not overly terse; each sentence adds value. The correlation method explanation could be seen as slightly verbose but is useful for usage judgment. Overall, it's efficient and front-loaded with the core purpose.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description is complete for an agent to call this tool correctly. It covers all parameters, return contents, and key behavioral caveats (heuristic marking, time bounding). Since there is an output schema, not describing the exact return structure is acceptable. The main gap is the lack of explicit guidance on when to prefer this over siblings, but that is partially covered by the correlation method description.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate. It does explain each parameter: capture_id (currently loaded capture), packet_number (positive one-based source frame number), window_seconds (seconds before/after, bounds and default), and limit (range and default). This adds meaning beyond the schema's type hints, making it easy for the agent to pass correct values.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: finding packets related to a selected packet or connection event. It specifies the resource (packets) and the action (find related), and the description of correlation methods (TCP/UDP stream, DNS/DHCP transaction IDs, etc.) distinguishes it from siblings like get_flow_packets or get_transaction_packets, which likely focus on specific relationships.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explains the correlation logic and when it falls back to heuristic methods, which gives context on when the results are reliable. However, it does not explicitly state when to use this tool instead of alternatives like get_flow_packets or get_packets_between_frames. The existence of siblings that focus on specific types of relationships implies usage contexts, but the description doesn't offer clear exclusions or alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden of behavioral disclosure. It does add meaningful context by stating that it 'iterates through the full capture,' implying a full-scan operation, and it clearly describes read-only reporting behavior. However, it does not address potential performance cost, failure conditions, or whether the capture must remain loaded, leaving some behavioral gaps.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with a front-loaded purpose, a usage hint, and an Args/Returns breakdown. It is concise and avoids fluff, though the Returns section partially repeats the output list already stated in the opening paragraph. This minor redundancy keeps it from a perfect score.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a single-parameter summary tool, the description covers what the tool does, when to use it, what it iterates over, and what it returns. An output schema is present, so return-value details are not the description's burden. It could be slightly more complete by noting performance expectations given the full-capture iteration, but overall it is sufficient for correct invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate for the undocumented capture_id parameter. It does so explicitly with 'Args: capture_id: ID of a currently loaded capture,' adding the crucial requirement that the capture must be currently loaded. This fully explains the single parameter beyond what the schema provides.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a specific verb ('Produce') and resource ('a quick packet-level overview of a loaded capture'), and lists the concrete outputs: packet count, protocol-layer names, timestamps, and duration. It also positions itself as the first analysis call after loading, which distinguishes it from deeper or narrower sibling tools like get_capture_statistics, get_capture_metadata, or get_capture_time_range.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

It explicitly states when to use the tool: 'useful as the first analysis call after loading.' This gives clear temporal/contextual placement among the sibling tools. It does not explicitly name alternatives or state when not to use it, so it stops short of a 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations providing read-only or destructive hints, the description carries the burden and does so well: 'Retrieve' implies a read operation, and it discloses the return contents including normalized type/key, generated display filter, packet count, truncation flag, and matching summaries. It does not cover error behavior or permission requirements, but it is substantially transparent.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description front-loads the core action rough and then minimizes necessary caveats about key formats. The Args and Returns blocks are compact, structured, and contain no filler or repetition of the schema.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's protocol complexity and four parameters, the description covers input semantics, protocol-specific edge cases, the required capture context, and the output shape. An agent has enough information to call the tool correctly without needing an additional example.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema has no property descriptions, so the Args section is the only semantic guide and it compensates fully. It defines capture_id, enumerates the allowed transaction_type values, explains protocol-specific transaction_key formats, and gives the limit range from 1 through 1000, going well beyond the bare property names.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('Retrieve'), a precise resource ('packets belonging to a DNS, DHCP, TCP, EAPOL, or ARP exchange'), and spells out the protocol scope. This distinguishes it from sibling packet-retrieval tools by focusing on transaction- or exchange-based lookups rather than frame numbers, time ranges, or flows.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives clear context about what kinds of keys apply to which protocols and notes that capture_id must reference a loaded capture. However, it never explicitly says when to choose this tool over the many packet-retrieval siblings, so an agent must infer the usage boundary rather than being told.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations present, the description carries the full burden of behavioral disclosure. It states that it 'reads only in-memory metadata and never rescans capture contents' and that 'decryption-key values are never returned,' giving meaningful behavioral context beyond the basic 'list' semantics.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well structured and front-loaded with the core purpose, followed by usage guidance, behavioral caveats, and return-value information. Every sentence adds value, and there is no fluff or repetition.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

This is a simple, zero-parameter listing tool with an output schema already present. The description nonetheless adds useful context about what the output contains and what is deliberately omitted, making it fully complete for an agent to call correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

This tool has zero parametersched, so parameter documentation is not needed. The baseline for a no-parameter tool is 4, and the description adds no unnecessary parameter information.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb ('List') and a precise resource ('every capture registered in the current MCP server session'). It also clarifies the tool's role by mentioning discovery of capture IDs and confirmation of load/reload/unload operations, which helps distinguish it from sibling tools like get_capture_metadata or load_capture.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly says when to use it: 'discover available capture IDs or confirm load/reload/unload operations.' It does not explicitly name alternatives or exclusions, but the context is clear enough for an agent to select it appropriately.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Since no annotations are provided, the description carries the full burden. It discloses that the server stores the resolved path and metadata in memory, does not copy or modify the file, does not keep it open, and that loading an existing ID is idempotent. This is valuable behavioral context. However, it does not mention access requirements or what happens if the file is invalid, but it does state the file must be accessible and have a valid extension. A minor gap is the lack of mention of error handling on invalid paths, but overall strong disclosure.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with a clear purpose statement, followed by important behavioral notes, and then formatted parameter details. It is front-loaded with the main instruction. There is no fluff; every sentence adds value. It is appropriately detailed for a tool with zero schema comments.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description is complete for the tool's complexity as a registration step. It covers all necessary information: when to use, what happens, parameter semantics, and return values. Although an output schema exists and might detail the return structure, the description gives a summary of return fields, which is sufficient. It does not need to describe other tools in depth as they're siblings. This is a comprehensive definition.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate. It does so by explaining that capture_id should be a session-unique name chosen by the caller and provides an example, and it specifies that file_path must be a local path to an existing .pcap or .pcapng file accessible to the server. It also notes whitespace trimming and file format restrictions, adding clear meaning beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: to register a local packet-capture file for subsequent analysis. It specifies the action ('Register'), the resource ('local packet-capture file'), and distinguishes it from siblings by emphasizing it is a prerequisite for tools that accept capture_id. It also mentions idempotency and the normalized ID.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly instructs to call this before using tools that accept capture_id, which is a clear when-to-use condition. It also mentions that loading an existing ID is idempotent, implying it's safe to reload. Although it doesn't explicitly say when not to use it, the context of being a registration step is clear. For a setup tool, this is sufficient.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden and does so well: it discloses that the tool verifies the file, updates path/size/mtime/load time, increments revision, and notably does not scan packets. This gives an agent a realistic picture of side effects and scope.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is efficiently structured with a purpose statement, a behavior paragraph, Args, and Returns. Every sentence adds value, and the key trigger condition is front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers purpose, side effects, parameter semantics, and return value nature. With only two simple parameters and an output schema present, nothing essential is missing for an agent to invoke this tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate. It does fully: capture_id is defined as a currently loaded capture, and clear_decryption_keys is explained with its behavior and default. No parameter is left ambiguous.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('Refresh') with a clear resource ('a loaded capture') and a precise trigger condition ('after its source file changes'). This clearly distinguishes it from loading, listing, or unloading captures.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description states clearly when to use it: after the source file changes while the capture is loaded. It does not explicitly name alternative tools or when-not-to-use it, but the context is clear enough to avoid confusion with load_capture or list_loaded_captures.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full disclosure burden and meets it thoroughly: keys exist only in server memory (transient state), secret values are never included in responses or normal logs (security behavior), supported key types are enumerated, and replace_existing semantics (append vs. replace, empty list clears) are stated. This goes well beyond what any structured field would reveal.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with a front-loaded purpose, followed by behavioral context, an Args block with a worked example, and a Returns summary. Every sentence earns its place, though the supported-key-types list and memory/security paragraphs could arguably be condensed without losing value.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 3-parameter mutation tool with no annotations and 0% schema coverage, the description covers everything an agent needs: purpose, transient memory model, secrecy guarantees, valid key type values, exact parameter semantics, and what the response contains (with values omitted). An output schema exists, so not detailing the return structure further is appropriate.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must fully compensate, and it does. It defines capture_id (currently loaded capture), keys (key_type and value fields with a concrete example showing the wpa-pwd 'password:SSID' format), and replace_existing (true replaces, false appends, empty list clears). The schema alone (array of objects with arbitrary string properties) would leave the agent unable to construct valid input.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The opening sentence states a specific verb (configure), resource (Wi-Fi decryption keys), and purpose (for later packet analysis). None of the 22 sibling tools (load_capture, filter_packets, dissect_packet, get_* queries) perform configuration of decryption material, so the purpose clearly distinguishes it from all siblings.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description conveys clear usage context: keys are configured 'for later packet analysis' and are 'passed to TShark whenever the capture is read', which implicitly tells the agent to set keys before reading/analyzing a capture and that keys are not persisted across sessions. It does not explicitly name alternatives or exclusions, but no sibling tool competes for this function, so the implicit guidance is sufficient.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description discloses important behavioral details beyond the schema: it forgets capture metadata and configured decryption keys, and it never deletes or changes the source file. This is valuable context for an agent deciding whether to call this tool, especially since no annotations are provided. It could additionally mention whether the operation is reversible, but the disclosed side effects are strong.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact and well-structured: a one-sentence summary, a clear side-effects paragraph, an Args section, and a Returns section. Every sentence earns its place and the most important behavioral caveat (does not delete source file) is front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a single-parameter tool with an output schema, the description covers the essential context: what the tool does, what side effects it has, what the parameter means, and what the return value is. It could be slightly more explicit about when to use it relative to reload_capture or list_loaded_captures, but overall it is complete enough for an agent to invoke it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema has 0% description coverage, so the description must compensate. It explains that capture_id is 'ID previously supplied to load_capture', which gives the agent the provenance and format expectation for the parameter. This is meaningful guidance beyond the bare schema definition.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action ('Remove a loaded capture from the current server session') and specifies the resource (a capture previously loaded via load_capture). It also explicitly distinguishes itself from deletion of the source file, which helps differentiate it from sibling tools like reload_capture or export_filtered_capture.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies when to use this tool: when a capture is loaded and you want to remove it from the session. It also clarifies what it does NOT do (never deletes or changes the source PCAP/PCAPNG file), which is a useful exclusion. However, it does not explicitly name alternative tools or state when not to use it, though the sibling list makes the context fairly clear.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the burden of behavioral disclosure. It clearly enumerates what the validation checks, notes that issue categories can overlap, and states that example_limit only limits retained examples while counts always include all matches. It does not explicitly state whether the operation is read-only, but 'validate' strongly implies a non-mutating analysis.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with a purpose statement, a checklist of validation categories, Args, and Returns. Each sentence adds information, and the most important purpose is front-loaded. No redundant or filler content is present.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool has an output schema, so return-value details do not need to be repeated. The description covers the operation, checked issues, both parameters, and the nature of results. It could be slightly more explicit about error behavior or prerequisites beyond 'currently loaded capture,' but it is otherwise complete for a validation tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate. It fully explains both parameters: capture_id is 'ID of a currently loaded capture' and example_limit is 'Maximum frame numbers retained for each issue, from 0 through 100,' adding the important behavior that counts include all matches. This goes well beyond the bare schema types.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'Validate capture readability and identify common packet-quality issues.' It goes on to list concrete checks (malformed packets, truncation, missing fields, decode failures, unsupported protocols, timestamps, chronological order), which clearly separates it from sibling summary/statistics tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage: call this when you need to validate a capture's readability and packet quality. However, it never explicitly states when to choose this tool over siblings like get_summary or get_capture_statistics, nor does it provide exclusions or alternative routing.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.