get_related_packets

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden. It discloses key behaviors: endpoint-based results are marked as heuristic and bounded by time, and it mentions the return includes a truncation flag and confidence. This goes beyond just saying 'returns related packets' and helps the agent understand the nature of the results (heuristic vs. exact). It doesn't mention any side effects (it's read-only), but that's implicit from the verb 'find.'

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with clear sections for Args and Returns. It is concise but not overly terse; each sentence adds value. The correlation method explanation could be seen as slightly verbose but is useful for usage judgment. Overall, it's efficient and front-loaded with the core purpose.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description is complete for an agent to call this tool correctly. It covers all parameters, return contents, and key behavioral caveats (heuristic marking, time bounding). Since there is an output schema, not describing the exact return structure is acceptable. The main gap is the lack of explicit guidance on when to prefer this over siblings, but that is partially covered by the correlation method description.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate. It does explain each parameter: capture_id (currently loaded capture), packet_number (positive one-based source frame number), window_seconds (seconds before/after, bounds and default), and limit (range and default). This adds meaning beyond the schema's type hints, making it easy for the agent to pass correct values.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: finding packets related to a selected packet or connection event. It specifies the resource (packets) and the action (find related), and the description of correlation methods (TCP/UDP stream, DNS/DHCP transaction IDs, etc.) distinguishes it from siblings like get_flow_packets or get_transaction_packets, which likely focus on specific relationships.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explains the correlation logic and when it falls back to heuristic methods, which gives context on when the results are reliable. However, it does not explicitly state when to use this tool instead of alternatives like get_flow_packets or get_packets_between_frames. The existence of siblings that focus on specific types of relationships implies usage contexts, but the description doesn't offer clear exclusions or alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.