review_auth_log

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description must fully disclose behavior. It states it summarizes entries since `since` but does not explain what 'summarize' means (e.g., counts by IP, failed vs. successful logins), whether it modifies logs, requires elevated privileges, or performance implications. The behavioral scope is incomplete.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is very short (one sentence) but lacks structure. It front-loads the purpose but omits important details. It is not verbose, but the brevity comes at the cost of completeness. A slightly longer description with structured details would be more effective.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given there are no annotations, an output schema exists which could describe the return format, but the description does not leverage this or explain return values. The tool has only one parameter but the description fails to describe its format or behavior comprehensively. The description is inadequate for an agent to use confidently without additional context.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so description must compensate. It mentions the `since` parameter but only says 'since `since`' which is redundant. It adds little meaning beyond the default value '24 hours ago' already in the schema. No details on format (ISO 8601, relative?), so the description provides minimal added value.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool summarizes sshd auth log entries on the local host since a given time. It specifies a verb ('summarize'), resource ('sshd auth log entries'), and scope ('local host since since'). It distinguishes from sibling tools that perform scans or audits of different resources.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description does not provide guidance on when to use this tool versus alternatives like check_scope or other audit tools. There is no mention of prerequisites (e.g., needing sudo), typical use cases, or scenarios where it should not be used. Agents must infer usage from context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.