search_scans

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden and does so excellently. It reveals error behavior (unknown top-level fields return an error; dotted-field typos return zero hits without error), result-limit semantics ('A total of 10000 means "at least 10000"'), and pagination mechanics ('Page forward by passing `next_cursor` back as `search_after`'). These details go far beyond what annotations would typically provide.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is dense but every sentence serves a purpose: purpose, auth, usage differentiation, field list, error nuance, examples, and pagination. It is well-structured in short paragraphs with code examples, and no information is repeated or wasted.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with ElasticSearch query syntax, the description covers the query language, supported fields, error edge cases, result cap, pagination, and even authentication. Given the output schema exists, it need not detail return values, and the provided context is sufficient for an agent to use the tool effectively across the sibling set.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%, so the description must compensate. It provides rich semantics for the `query` parameter through field lists and examples (e.g., 'domain:"evil.tld"'), and explains `search_after` via the pagination note. However, the `size` parameter is never mentioned, leaving its semantics entirely to the schema (which shows a default of 20 but no explanation). Minor gap, but the description makes the two most complex parameters clear.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a clear verb and resource: 'Search historical urlscan.io scans with an ElasticSearch query string.' It also distinguishes itself from the sibling tool `pivot`, which is explicitly mentioned for single-indicator use cases, making the purpose and differentiation unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

It explicitly states when to use this tool ('Use this for free-form queries') and when to use an alternative ('use `pivot` when you have a single indicator and want the field chosen for you'). It also notes the auth requirement ('Works without an API key') and provides concrete query examples, giving the agent clear context for tool selection.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.