Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description uses a 'DESTRUCTIVE' warning and mentions the confirmation flow, which adds transparency. However, it does not detail specific behavioral traits such as potential impact on the agent, permissions required, or whether the command runs synchronously. With no annotations, the description carries full burden but is not exhaustive.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is exceptionally concise: two lines with clear front-loading of the destructive warning. Every sentence adds value, including the safety reminder. No unnecessary words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Although the output schema exists and the description covers key safety aspects, it omits details like return value format, required agent state (e.g., online), or that the command runs via active-response. For a destructive tool with 4 parameters, more context would be beneficial.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, with each parameter already well-described (e.g., 'Full command string to execute on the agent (use with extreme caution)'). The tool description adds little beyond what the schema provides, repeating safety cues. Baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool executes an arbitrary command on a remote Wazuh agent via active-response infrastructure. The verb 'execute' and resource 'remote Wazuh agent' are specific. It distinguishes from siblings like wazuh_run_active_response by mentioning the same confirmation flow.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides some guidance on the confirmation flow and safety requirement, but does not explicitly state when to use this tool versus alternatives like wazuh_run_active_response. It lacks explicit when-not-to-use conditions or comparison to siblings.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It indicates a read-only, aggregate operation (counts, distributions), but does not explicitly state that it is non-destructive, mention potential performance impact, or specify if it requires special permissions. More explicit safety or scope details would improve transparency.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Description is a single, efficient sentence that delivers the core functionality first and then lists details. It is well-structured and contains no superfluous words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's simplicity (one parameter, output schema present), the description covers the key results: connection counts, OS/platform, version distribution, and stale agents. It does not elaborate on the output format or edge cases, but with an output schema available, this is acceptable.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The only parameter, stale_threshold_hours, is already fully documented in the input schema with a clear description and default value. The tool description adds no additional meaning beyond that, so a baseline score of 3 is appropriate given 100% schema coverage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

Description clearly states the tool fetches a fleet-wide health overview with specific breakdowns: counts by connection status, OS/platform, version distribution, and stale agents. The verb 'Get' and resource 'health overview' are precise, and it distinguishes from sibling tools like wazuh_list_agents which show raw agent lists.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly says 'Use this for daily ops check or before an investigation,' providing clear context for when to use. However, it does not mention when not to use it or suggest alternatives, such as using wazuh_list_agents for detailed agent data.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided, so description carries full burden. It implies read-only behavior but does not explicitly state idempotency, auth requirements, or rate limits. It lists what the summary contains, which adds some transparency.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Two concise sentences, front-loaded with key information, no redundancy. Every word earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With output schema present and simple parameters (2 optional), the description is complete for its complexity. Could mention return format briefly, but not required.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% with clear descriptions for both parameters. The description does not add significant meaning beyond the schema, meeting the baseline of 3.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it provides a high-level summary of recent alerts, listing specific components like severity distribution, top IPs, rules, and MITRE coverage. This distinguishes it from sibling tools like wazuh_list_alerts (lists all alerts) and wazuh_get_alert (single alert).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly says 'Use this as the first step in security posture assessment or shift handoff,' giving clear when-to-use context. Could mention when not to use or alternatives, but current guidance is sufficient.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description must carry the full burden. It clearly states the tool retrieves statistics and enumerates the data categories (EPS, queues, daemon, utilization). This is sufficient to convey that the operation is read-only and diagnostic. Additional details about error handling or limits are not needed given the simplicity.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences with zero waste. The first sentence states the action and resource, the second adds value by listing examples and use case. Front-loaded and efficient.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a single-parameter tool with an output schema, the description is complete. It explains the tool's purpose, the kind of data returned, and its utility. No gaps remain given the sibling context and available structured metadata.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, with a clear description of 'node_id' including examples. The description does not add new information beyond stating it is 'for a specific Wazuh cluster node', which is already implicit in the parameter name and schema. Per guidance, baseline 3 is appropriate when schema already documents parameters well.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

Description uses specific verb 'Get detailed statistics' and identifies the resource as 'a specific Wazuh cluster node'. It lists the types of data shown (EPS, queue sizes, daemon status, resource utilization), clearly distinguishing it from sibling tools like wazuh_cluster_status which likely covers cluster-wide stats.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The phrase 'Essential for diagnosing cluster imbalances' provides a clear use case. While it does not explicitly state when not to use or list alternatives, the purpose is specific enough that an agent can infer it is for deep-dive node analysis versus higher-level cluster overview tools. This is adequate but not exhaustive.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided, so description carries burden. It implies read-only operation but does not disclose potential costs, permissions needed, or other behavioral traits beyond what is stated.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences: first sentence states purpose, second gives usage context. No redundant words; efficient and front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the simplicity (one optional param, output schema present), the description adequately covers purpose and usage. However, could benefit from clarifying scope (e.g., all nodes vs current node) even though implied.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% and the single boolean parameter 'include_nodes' is self-explanatory from the schema description. The tool's description adds no additional meaning beyond the schema's description.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description specifies the verb 'Get' and resource 'Wazuh cluster health status', listing specific return contents (node list, sync status, connectivity) which clearly distinguishes it from sibling like wazuh_cluster_node_stats.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly states when to use ('when checking if the cluster is healthy or diagnosing replication failures') but does not mention when not to use or alternative tools.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided, so description must carry behavioral info. It accurately describes output as a report without side effects. Could mention it does not modify state, but implied by 'report'.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Three sentences: action, output details, use case. Every sentence adds distinct value with no redundancy. Front-loaded with key info.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With an output schema present, description does not need to detail return format. It names key fields (agent, scores, failed-check counts, policy). Missing mention of data freshness or limits, but sufficient for decision-making.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% with a parameter description clarifying comma-separated agent IDs/groups. The tool description adds minimal extra meaning beyond that; baseline score holds.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

Clearly specifies the tool generates a compliance summary report and details what it shows (SCA enabled, scores, failed-check counts grouped by policy). Distinct from siblings like wazuh_sca_checks which focus on individual checks.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

States 'Ideal for audit prep' giving a clear use case, but does not explicitly mention when to use alternatives like wazuh_sca_status or wazuh_sca_checks for finer detail.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It states it gets detailed information but does not disclose behavioral traits such as whether it mutates state, required permissions, error handling for invalid agent IDs, or rate limits. Limited transparency.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Single sentence, efficient, front-loaded with the verb 'Get'. Every word adds meaning, no redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple get-info tool with an output schema, the description is sufficiently complete. It covers the key aspects of what is retrieved. Could briefly mention that response details are in the output schema, but not necessary.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% (one required parameter with description). The description adds value by listing the types of information returned (configuration, OS details, etc.), which goes beyond the schema's description of agent_id.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's function: 'Get detailed information about a specific agent' and lists specific data categories (configuration, enabled modules, OS details, group membership, connection history). This distinguishes it from siblings like wazuh_list_agents (which lists agents) and wazuh_agent_health (likely health-focused).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage for retrieving detailed agent info but does not explicitly state when to use this tool versus alternatives like wazuh_agent_health or wazuh_list_agents. No exclusions or prerequisites are mentioned.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description bears the full burden of disclosing behavioral traits. It claims 'full contextual detail' but does not describe whether the operation is read-only, requires authentication, or has any side effects. The tool is likely read-only, but this is not stated.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description consists of two concise, front-loaded sentences. The first sentence defines the tool's action and result, the second provides usage guidance. No extraneous information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool has one simple parameter and an output schema (as indicated by context signals), the description is fairly complete. It explains the purpose and when to use it. It could elaborate on what 'full contextual detail' entails, but the output schema likely covers the return format.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema covers 100% of the single parameter 'alert_id', including its description. The tool description adds 'full contextual detail' about the response, but does not elaborate on the parameter beyond what the schema provides. Baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb 'Fetch', the resource 'single Wazuh alert', and the key attribute 'by its ID'. It explicitly distinguishes from sibling 'wazuh_list_alerts' by specifying that this tool is for investigating a specific alert from that tool's results.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly states when to use the tool: 'when investigating a specific alert from wazuh_list_alerts results.' This provides clear context and differentiation from sibling listing tools. It does not mention when not to use, but the guidance is sufficient.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description bears full burden for behavioral traits. It indicates the operation is read-only ('Read the contents') and returns key-value entries. However, it does not disclose potential errors, authentication requirements, or rate limits. The description is adequate but not comprehensive.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Two concise sentences: first states the action, second provides context and return format. No redundant information. Slight room for improvement with bullet points or examples.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a read tool with an output schema, the description adequately covers purpose, use case, and return type. It does not mention pagination or filtering beyond what's in the schema, but the schema itself provides that. Given the tool's simplicity, it is complete enough.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the parameters are already well-documented. The description adds common-use examples for CDB lists but does not improve parameter understanding beyond the schema. Baseline 3.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool reads a specific CDB list and explains the purpose of CDB lists (IP reputation, whitelists, IOC matching). It distinguishes from general list retrieval (wazuh_list_cdb_lists) by specifying 'contents of a specific CDB list', but could explicitly contrast with the sibling tool.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

No explicit guidance on when to use this tool versus alternatives (e.g., wazuh_list_cdb_lists to first obtain list names). The description does not mention prerequisites or typical usage context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description uses 'get' which implies read-only, but it does not explicitly state that this is a read-only operation with no side effects. Since no annotations are provided, the description should more clearly disclose the read-only nature to aid safe agent usage.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single concise sentence of 15 words, directly stating the tool's purpose and what it returns. No unnecessary words or redundant information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description mentions the returned details (configuration and member agents) and, combined with the output schema, provides sufficient context. It does not mention prerequisites like group existence, but the simple parameter and output schema mitigate the need.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema provides 100% coverage for the only parameter (group_id) with a clear description and examples. The tool description does not add any additional parameter information beyond what the schema already provides.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it gets detailed information about a specific agent group, including configuration and member agents. This distinguishes it from siblings like wazuh_list_groups (list all groups) and wazuh_group_agents (list agents in a group), as it provides a single group's full details.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

While the description implies this tool is for detailed group info, it does not explicitly state when to use it versus siblings like wazuh_list_groups for overviews or wazuh_group_agents for agent lists. No usage prerequisites or exclusions are mentioned.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description indicates a read-only listing operation, which implies no side effects. However, no annotations are provided, and the description does not disclose any additional behavioral traits such as authentication requirements or rate limits. It is minimal but adequate.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Extremely concise: a single sentence that communicates the core purpose without any fluff.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the output schema exists and the input schema covers all parameters, the description is complete enough for a simple listing tool. It could mention that it returns agent details, but that is covered by the output schema.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3. The description does not add any extra semantics beyond what the schema already provides for group_id, limit, and offset.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool lists agents by group, distinguishing it from sibling tools that list all agents (wazuh_list_agents) or single agent details (wazuh_get_agent). However, it does not explicitly differentiate from similar list tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this tool versus alternatives. For example, no mention that this filters agents by group, while wazuh_list_agents returns all agents.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries full responsibility for behavioral disclosure. It discloses that the tool traces back through related events on the 'same agent' and builds a chronological timeline. While it does not mention whether it is read-only or potential failure modes, the key behavioral aspects are sufficiently covered.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is extremely concise—two sentences that immediately convey the tool's purpose and key behavior. No superfluous information, and the critical details are front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool has an output schema and moderate complexity, the description adequately covers the core functionality (tracing events on the same agent, chronological timeline). It does not explain edge cases or what constitutes 'related events,' but the output schema likely handles return structure, making this sufficient.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema coverage is 100%, with all three parameters having descriptions (alert_id, lookback_hours, max_events). The description reinforces the purpose of the tool but does not add significant new meaning beyond the schema. Thus, baseline score of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: after identifying a security incident, reconstruct a timeline of related events from a given alert ID. It uses specific verbs ('reconstruct', 'traces back', 'builds') and distinguishes itself from siblings like wazuh_get_alert (single alert) and wazuh_search_events (general search).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description indicates when to use the tool ('after identifying a security incident'), providing clear context. However, it does not explicitly state when not to use it or mention alternative tools for different scenarios, which would be helpful for an AI agent deciding between similar tools.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the burden. It states what the tool returns and its filtering capabilities, which is expected. However, it does not disclose any side effects, authorization needs, or rate limits, which would be required for a higher score.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence that front-loads the core action and output, then lists key features. Every part is informative and there is no wasted text.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool has 6 optional parameters, an output schema, and is a simple listing operation, the description covers the main points: what it does, what it returns, and how to filter/paginate. It omits details about sorting and the 'older_than' parameter, but the output schema exists to provide additional context.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the schema already documents each parameter. The description adds value by summarizing key parameters (status, search, pagination) but does not introduce new meaning or usage details beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action ('List'), resource ('all Wazuh agents'), and the key attributes returned ('status, OS, version, and last connection'). It effectively distinguishes from sibling tools like wazuh_get_agent (single agent) and wazuh_agent_health (health status).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides specific usage guidance: filtering by status, searching by name/IP, and controlling pagination. It implicitly tells the agent when to use this tool (for listing agents with filters), but lacks explicit comparison to alternatives like wazuh_get_agent for single-agent queries.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It does not disclose whether the tool is read-only, what the response format looks like, or any side effects. The name implies a read operation, but explicit statements about behavior are missing.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences with no redundancy. The first sentence states the core purpose, and the second lists use cases. Every word earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool has 10 optional parameters and an output schema exists, the description is brief but adequate. It could mention pagination defaults or output structure, but the parameter schema covers details, and the output schema likely clarifies return values.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already explains each parameter. The description adds value by framing the tool's purpose but does not provide additional semantic meaning beyond the schema. Baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a clear verb 'Query' and resource 'Wazuh security alerts', and provides specific use cases (triage, hunt, overview). While it doesn't explicitly differentiate from siblings like wazuh_get_alert or wazuh_alert_summary, the use cases imply a general listing/filtering role.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives concrete scenarios for using this tool: triaging incidents, hunting for threat patterns, or getting an overview. However, it does not mention when to avoid using it or suggest alternative tools for single-alert retrieval or summaries.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided, so description carries full burden. It states 'List all CDB lists' accurately, but does not disclose behavioral nuances such as performance, pagination details, or authentication requirements. Adequate for a simple read operation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Description is three sentences: primary action, explanation of CDB lists, and value statement. No extraneous information; front-loaded and efficient.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given a simple list tool with output schema and well-documented parameters, the description is mostly complete. It could add a brief note about pagination or search functionality, but overall adequate.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so baseline is 3. Description does not add additional meaning beyond schema descriptions for search, limit, and offset. No extra context provided.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

Description clearly states 'List all CDB lists' with a specific verb and resource, and explains what CDB lists are. Distinguishes from sibling wazuh_get_cdb_list implicitly, but could explicitly mention when to use each.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Description mentions it's 'Essential for understanding what threat intelligence feeds are active,' which implies a use case. It does not provide when-not-to-use guidance or explicitly refer to alternatives like wazuh_get_cdb_list.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description provides basic behavioral context (listing groups, utility) but lacks details on authentication, rate limits, or pagination behavior beyond what the schema implies.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two concise sentences that front-load the main action and provide context, with no wasted words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's simplicity and the presence of an output schema, the description covers the purpose and use case well, though it could mention the return format explicitly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the baseline is 3. The description adds no extra meaning beyond the schema's parameter descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool lists all Wazuh agent groups, explains their purpose, and distinguishes itself from siblings like 'wazuh_get_group' by focusing on listing all groups.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage for scoping queries and active responses but does not explicitly mention when not to use it or compare to alternative tools like 'wazuh_get_group' or 'wazuh_group_agents'.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided, so description carries full burden. It discloses filtering, searching, and pagination, but lacks details on potential errors, rate limits, or response structure.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Single sentence that is front-loaded and informative, with no unnecessary words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Description covers purpose, parameters, and usage context. Output schema exists, so no need to explain return values. Could mention potential limitations or common use cases.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so baseline is 3. Description restates parameter purposes (category filter, search, pagination) but does not add significant new meaning beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

Description clearly states the tool retrieves Wazuh manager logs for troubleshooting, distinguishing it from sibling tools that focus on agents, alerts, or other aspects.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Description implies usage for troubleshooting and mentions filtering by category, search, and pagination, but does not explicitly state when to use this tool over others or specify exclusions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It describes the tool as a retrieval operation with no side effects mentioned, but it does not explicitly state it is read-only or discuss any impact. A 3 is appropriate as it is truthful but lacks depth.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Two concise sentences, front-loaded with the main action. Every word adds value with no redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple tool with one optional parameter and an output schema, the description covers purpose and use cases. It could mention that omitting daemon returns all stats, but the schema’s default behavior is clear. The output schema handles return value details.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 100% coverage for the single parameter 'daemon', listing valid values. The description adds high-level context about the stats returned but doesn't detail how the parameter affects output. Baseline 3 for good schema coverage with minor added value.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool retrieves Wazuh manager daemon statistics, listing specific metrics (EPS, queue sizes, etc.). It distinguishes from sibling tools like wazuh_cluster_node_stats and wazuh_manager_logs by focusing on manager daemon internals vs. cluster or logs.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly identifies use cases: 'capacity planning and troubleshooting performance issues.' While it doesn't mention when not to use or alternatives, the context is sufficient for typical selection.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description must disclose behavioral traits. It states the tool shows file changes (added, modified, deleted) but does not cover pagination limits, performance implications, or error handling for missing agents.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Two efficient sentences with no wasted words. Front-loaded with purpose and use cases.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given 6 parameters (1 required) and an output schema, the description covers purpose, use cases, and basic behavior. It is mostly complete but lacks details on limits and error scenarios.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% so all parameters are described there. Description adds context about use cases but does not significantly enhance meaning beyond the schema's parameter descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

Description clearly states verb 'Query' and resource 'File Integrity Monitoring (FIM) records', and specifies what it does: show added, modified, or deleted files. The name and description make it distinct from sibling tools like wazuh_query_vulnerabilities.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Description mentions 'Essential for breach impact analysis and configuration drift detection', implying when to use it, but lacks explicit guidance on when not to use it or how it differs from alternatives like wazuh_search_events which may also query FIM data.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided, and description lacks behavioral details like read-only nature, pagination (though params hint), error handling, or required permissions. Does not disclose any side effects.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Two concise sentences. Front-loaded with primary action. No unnecessary words. Could be structured with more detail on usage.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given 6 parameters, output schema present, and no annotations, description covers basic purpose but lacks behavioral and usage context. Adequate but incomplete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so baseline 3. Description only reiterates filter options already in schema; no additional semantic context or parameter usage examples.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

Clearly states it queries vulnerability-detector inventory for CVEs with filters. Includes specific filter examples (severity, agent, CVE ID). However, it does not differentiate from sibling tool wazuh_vulnerability_heatmap.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this tool over siblings, prerequisites (e.g., agent existence), or scenarios. Only implicit context that it's for querying vulnerabilities.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries full responsibility for behavioral disclosure. It states the tool 'generate[s] a coverage map' and mentions analysis, but does not describe side effects (likely read-only), computational cost, or limits in detail. The limit parameter (1-1000) is implied but not emphasized as a behavioral constraint. The output schema exists and covers return values, partially mitigating the lack of description.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence that front-loads the primary action and resource, then adds context. It is concise and efficient, with no redundant information. A slightly more structured format (e.g., separate sentences for purpose and usage) could improve readability, but the current form is effective.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool has moderate complexity (3 parameters, output schema present). The description covers the main use case and the output is detailed by the output schema. It does not explain the return format or provide examples, but given the schema richness, this is acceptable. Sibling tools exist but are not referenced, which would have improved completeness.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%: each parameter has a description (framework with list of frameworks, min_level default 5, limit default 500). The description adds context by listing the frameworks and tying to compliance analysis, but does not provide significant additional meaning beyond the schema. The baseline of 3 is appropriate given high schema coverage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses specific verbs ('generate a coverage map') and clearly identifies the resource ('Wazuh rules' mapping to multiple frameworks). It names the specific compliance frameworks (MITRE ATT&CK, NIST 800-53, etc.) and explicitly states the purpose ('compliance gap analysis and detection engineering'). This clearly distinguishes it from sibling tools like 'wazuh_compliance_report' or 'wazuh_search_mitre' which have different scopes.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description mentions the tool is 'essential for compliance gap analysis and detection engineering', providing a clear use case. However, it does not explicitly state when to use this tool versus alternatives (e.g., 'wazuh_compliance_report' for general reporting or 'wazuh_search_mitre' for MITRE-specific queries). No exclusions or prerequisites are mentioned.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It describes the tool as a search/list operation with no side effects, but does not explicitly state read-only behavior, authentication requirements, or rate limits. The description is clear enough for a read-only query tool, but lacks explicit behavioral disclosures.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise—three sentences that front-load the primary purpose, followed by filtering capabilities and utility. No extraneous words, every sentence earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the presence of an output schema (context states 'Has output schema: true'), the tool description does not need to explain return values. It covers purpose, key parameters, and use case adequately for a search/list tool with 9 parameters. Slight deduction for missing usage guidelines.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 100% description coverage for all 9 parameters. The description mentions filter options but adds no semantic value beyond the schema's parameter descriptions (e.g., level range, compliance IDs). Baseline 3 is appropriate given high schema coverage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description explicitly states the tool's purpose: 'Search and list Wazuh detection rules.' It includes specific filtering capabilities (rule level, compliance frameworks, MITRE ATT&CK) and frames it as essential for understanding detection coverage and tuning rules, clearly differentiating from sibling tools like wazuh_rules_coverage_map.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides no guidance on when to use this tool versus alternatives (e.g., wazuh_rules_coverage_map), nor does it specify prerequisites or when not to use it. It only lists features without contextual usage advice.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description fully discloses the destructive nature, the safety layer (confirmation prompt, token requirement), and that it does not execute by default. This is highly transparent and covers all critical behavioral aspects.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Two clear paragraphs: first warns of destructiveness and lists examples, second explains safety process. Every sentence adds value, no redundancy. Front-loaded with critical warning.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a destructive tool with a complex safety flow, the description covers default behavior, confirmation process, token requirements, and common commands. Output schema exists, so no need to describe return values. Complete for the context.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so baseline is 3. The description adds context about the safety mechanism but does not elaborate on parameter details beyond what the schema already provides. The command and arguments examples are helpful but not extensive.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description starts with 'Trigger an active-response command on a Wazuh agent' and lists examples like blocking IPs, quarantine, custom scripts. It clearly identifies the verb (trigger/run) and resource (active response on agent), distinguishing it from siblings like wazuh_agent_command which likely sends generic commands.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly states the default no-execution behavior and the two-step confirmation process with token. It provides common command values and argument format. While it doesn't explicitly compare with siblings, the safety mechanism strongly guides usage, earning a 4.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description bears full responsibility for behavioral disclosure. It only states that the tool returns check results with filtering, but does not mention whether it is read-only, authentication requirements, rate limits, or data freshness. The read-only nature is implied but not explicitly confirmed, which is a gap for a query tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, clear sentence that is front-loaded with the primary action. It contains no redundant words or information, earning its place by succinctly conveying functionality and key filtering options.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given that the tool has an output schema (not shown but indicated), return values are already documented. With 6 parameters all described in the schema, and the tool description covering the main filtering options, the description is complete enough for a query tool. A score of 5 would require explicit usage timing or integration hints, which are absent.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the baseline is 3. The tool description adds a summary of filtering capabilities ('Filter by policy, search, or result status'), which aligns with the schema descriptions but does not add new meaning beyond them. The schema already adequately documents all parameters, including default values and types.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it retrieves SCA check results for an agent, with filtering by policy, search, or result status. The verb 'Get' and resource 'SCA check results' are specific, and it distinguishes from sibling tools like 'wazuh_sca_status' which deals with policy-level status.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage for detailed compliance checks, but it does not explicitly state when to use this tool versus alternatives like 'wazuh_sca_status' or 'wazuh_compliance_report'. No 'when not to use' guidance is provided, leaving the agent to infer context from sibling names.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries full burden. It describes the returned data (policies, counts, scores) but does not explicitly state whether the operation is read-only, non-destructive, or has any side effects. The read-only nature is implied but not confirmed.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Two concise sentences, front-loaded with the verb 'Get' and resource 'SCA compliance status'. No redundant words; every sentence adds value.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool has a single parameter and output schema, the description adequately covers the tool's purpose and what it returns. No gaps given the complexity level.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% for the single parameter with a default and description. The description adds context about using the default for the manager itself, which complements but does not significantly extend the schema. Baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool retrieves SCA compliance status for an agent, listing specific outputs (policies, pass/fail counts, overall scores). It distinguishes itself from sibling tools like wazuh_sca_checks by focusing on status rather than individual checks.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies use for checking compliance status on a specific agent and mentions the default agent_id. However, it does not explicitly guide when to use this tool versus alternatives like wazuh_sca_checks (detailed checks) or provide usage exclusions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries full burden. It describes the tool as searching raw events and mentions IOCs, implying a read-only operation. However, it does not explicitly confirm it is non-destructive, nor does it disclose any pagination, rate limits, or scope limitations beyond the schema.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences with no wasted words. The first sentence specifies the action and scope; the second provides usage examples and purpose. Front-loaded and efficient.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (5 parameters, output schema exists), the description adequately covers the core purpose and usage. The schema details parameters and the output schema explains return structure, so the description does not need to reiterate those.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so baseline is 3. The description adds minimal value by giving examples of search terms (IPs, file hashes, commands) but these are already implied by the parameter description 'Search term — IP address, file hash, command, process name, etc.' in the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states 'Search raw security events across all Wazuh agents' — a specific verb and resource. It distinguishes from sibling tools like wazuh_search_mitre (MITRE techniques) and wazuh_list_alerts (alerts) by specifying 'raw security events' and mentioning IOCs.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description specifies 'Use this for deep threat hunting' and provides IOC examples, giving clear context. However, it lacks explicit guidance on when not to use this tool or alternatives, such as wazuh_list_alerts for filtered alerts or wazuh_search_mitre for MITRE technique search.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description must convey behavioral traits. It describes search/lookup functionality but does not explicitly state that the tool is read-only (no side effects) or outline pagination behavior (despite limit/offset parameters). The output schema may cover return format, so the description is adequate but lacks explicit safety or pagination context.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, front-loaded with the core function, followed by practical use cases. Every sentence provides value with no redundancy or filler. The structure is efficient and directly addresses what the tool does.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given 4 optional parameters and an existing output schema, the description covers the main functionality (search, lookup, mapping) effectively. However, it omits details on how search and technique_id parameters work together, and does not mention pagination behavior (limit/offset) that users might need to know. Still, it is largely complete for a search tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3. The description does not add meaning beyond the schema: it repeats the search keyword description and does not elaborate on how parameters interact (e.g., combining search and technique_id) or provide examples. No additional semantic value is offered.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description explicitly states it searches the MITRE ATT&CK framework integrated with Wazuh, and lists specific use cases: looking up techniques, finding Wazuh rule mappings, and discovering technique coverage. This clearly distinguishes it from sibling tools like wazuh_rules_info or wazuh_rules_coverage_map, which focus on rule details rather than MITRE framework search.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies the tool is for MITRE-related inquiries but provides no explicit guidance on when to use it versus alternatives like wazuh_rules_info for rule details, or when not to use it. No alternatives or exclusions are mentioned, leaving usage context implicit.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It implies a read-only operation generating a heatmap, but does not disclose behavioral details such as data aggregation scope, time range considerations, or output format. Adequate but not comprehensive.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences with no wasted words. It efficiently conveys purpose, output, and use case.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given low complexity (1 optional parameter, has output schema), the description adequately covers purpose and use. It could mention that the output is a heatmap visualization, but overall it is sufficient for an agent to understand when and how to use it.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, and the input schema already describes the 'severity' parameter and its possible values. The description does not add additional meaning beyond what the schema provides, so baseline score of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses specific verbs ('Generate', 'Identifies') and resources ('vulnerability heatmap', 'CVE severity distribution across agents'). It clearly distinguishes from siblings like wazuh_query_vulnerabilities by focusing on visualization and patch prioritization.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description states it is 'Essential for patch prioritization' and identifies systems with critical vulnerabilities, providing clear usage context. However, it does not explicitly mention when not to use or direct to alternatives among siblings.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.