Vicarius vRx MCP Server
Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@Vicarius vRx MCP Serversearch for vulnerabilities with severity critical"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Vicarius vRx MCP Server
A Model Context Protocol server that exposes the
Vicarius vRx External Data API (REST) to AI assistants. It provides 88 tools across 37
API domains — Vulnerabilities/CVEs, Endpoints (Assets), Patches & Updates, Publishers &
Products, Tasks & Events, Automations & Scripts, Users, and more — plus a generic
vrx_request escape hatch for anything not covered by a dedicated tool. The tool set is
generated directly from the vRx OpenAPI specification, so it stays faithful to the real
API surface, and the generated output is deterministic and committed.
Unofficial project. This is an independent, internally-built MCP server developed against Vicarius's published API documentation. It is not an official Vicarius product and is not affiliated with, endorsed by, or supported by Vicarius. "Vicarius" and "vRx" are trademarks of their respective owner. For official support of the vRx platform or the API itself, contact Vicarius directly.
Beta software — not yet recommended for production. This project is under active development. The tool surface may still change between versions, and not every endpoint has been exercised against every tenant/entitlement configuration.
This server can perform destructive actions against your vRx tenant. Tools can delete assets and asset groups, create/update/delete users and invitations, modify automations and scan inputs, and update tasks. A hallucinated tool argument from your AI assistant could change your tenant configuration.
Recommended posture:
Run read-only first. Set
VRX_READ_ONLY=trueto register only read tools and makevrx_requestreject any non-GET request. Lift it only when you need to write.Use a vRx API key scoped to the minimum permissions your use case requires.
Review every mutating tool call before allowing execution. Claude Desktop requires tool-call approval by default — keep that enabled.
Treat the API key with the same care as portal admin credentials.
The HTTP transport binds to
127.0.0.1by default. Do not expose it to the public internet without adding authentication.
Tools
88 tools across 37 API controllers (59 read + 29 mutating), plus the vrx_request escape
hatch — 89 total in full mode, 60 in read-only mode (mutating tools are not registered when
read-only). The table below groups the controllers into functional domains.
Domain | Read | Write | Notable tools |
Vulnerabilities & CVEs | 9 | 0 |
|
Endpoints (Assets) | 7 | 5 |
|
Patches & Updates | 11 | 3 |
|
Publishers, Products & OS | 9 | 0 |
|
Tasks & Events | 10 | 7 |
|
Automations & Scripts | 9 | 9 |
|
Users & Invitations | 3 | 5 |
|
Utilities | 1 | 0 |
|
See docs/ENDPOINTS.md for the full tool ↔ method ↔ path mapping (all
88 tools with their mutating flag).
Highlights:
Search tools (
endpoint_search,vulnerability_search,organization_endpoint_group_search, …) accept an RSQLqfilter plusfrom/sizepaging — see Querying.Filter / count tools (
*_filter,*_count) cover event streams (incident events, task events) and counts for dashboards.Aggregation tools (
aggregation_group,aggregation_search_group) power grouped/rollup queries (e.g. count of active CVEs grouped by vulnerability).vrx_requestescape hatch issues an arbitrary request against the API for any endpoint without a dedicated tool. In read-only mode it rejects every non-GET method.Read-only safety is enforced at two layers — mutating tools are never registered in read-only mode, and
vrx_requestindependently refuses mutations.
Related MCP server: VulnMCP
Quick start
Install
# with uv (recommended)
uv tool install vrx-mcp
# or with pip
pip install vrx-mcpThis installs the vrx-mcp console script. For development from source:
git clone https://github.com/Space-C0wboy/vicarius-vrx-mcp-server
cd vicarius-vrx-mcp-server
python -m venv .venv
.venv/Scripts/python -m pip install -e ".[dev]" # Windows
# .venv/bin/python -m pip install -e ".[dev]" # macOS/LinuxGetting an API key
In the vRx portal, go to Settings, select the api tag, then Create Integration.
Copy the generated API key — this is your
VRX_API_KEY.Your base URL is
https://<your-dashboard>.vicarius.cloud/vicarius-external-data-api.
Requests authenticate with the vicarius-token header (the API key value); this server
sets it for you on every request.
Configuration
Copy .env.example to .env and set:
Variable | Required | Default | Description |
| yes | — | Your vRx API key (Settings → api → Create Integration) |
| yes | — | Full API base URL, e.g. |
| no |
| Header name carrying the API key |
| no |
| When true, no mutating tools are registered and |
| no |
| Request timeout in seconds |
| no |
| Logging level (logs go to stderr) |
| no |
| HTTP transport bind |
Run
stdio (default, for Claude Desktop/Code):
vrx-mcpHTTP:
vrx-mcp --transport http --port 8765
Querying
vRx search endpoints use RSQL in the q query parameter:
Operator | Meaning | Example |
| equals |
|
| in list |
|
| regex match |
|
| compare |
|
Pagination: every query takes from (offset) and size. size ≤ 500 per request and
from ≤ 10,000. To page beyond offset 10,000, use seek paging: keep from=0, add a
sort (e.g. -endpointId), and add a q comparison on the last value seen
(e.g. q=endpointId<525236), repeating until the result is empty.
Response envelope: responses wrap results in a standard shape —
serverResponseResult.serverResponseResultCode ("SUCCESS"), serverResponseCount (total
matching records), and serverResponseObject (the array of records).
Rate limits: the API allows 60 queries / 60 seconds per organization scope and returns
HTTP 429 with an X-Rate-Limit-Retry-After-Seconds header when exceeded. The client
automatically retries 429s (and transient 5xx/network errors) with backoff, honoring that
header.
Read-only mode
Set VRX_READ_ONLY=true to run the server safely against production. In this mode:
No mutating tools are registered — only the 59 read tools (+
vrx_request) are exposed.vrx_requestrejects any non-GET method, so it can only run read operations.
Read-only mode is strongly recommended for analyst-assistant, reporting, and dashboard use
cases where the model should never change tenant state. The shipped .env.example defaults to
read-only.
Editor integration
Claude Code
claude mcp add vrx \
--env VRX_API_KEY=your-key-here \
--env VRX_BASE_URL=https://your-dashboard.vicarius.cloud/vicarius-external-data-api \
--env VRX_READ_ONLY=true \
-- vrx-mcpClaude Desktop
Edit claude_desktop_config.json:
macOS:
~/Library/Application Support/Claude/claude_desktop_config.jsonWindows:
%APPDATA%\Claude\claude_desktop_config.json
{
"mcpServers": {
"vrx": {
"command": "vrx-mcp",
"env": {
"VRX_API_KEY": "your-key-here",
"VRX_BASE_URL": "https://your-dashboard.vicarius.cloud/vicarius-external-data-api",
"VRX_READ_ONLY": "true"
}
}
}
}Restart Claude Desktop, then confirm vrx appears in the tools menu.
Example prompts
"List the first 100 assets in vRx." →
endpoint_search(from=0,size=100)."Find the asset named HOST01." →
endpoint_search(q=endpointName=='HOST01')."Show me all Critical CVEs." →
vulnerability_search(q=vulnerabilitySensitivityLevel.sensitivityLevelName=='Critical')."Which assets are affected by CVE-2024-3094?" →
vulnerability_searchto resolve the CVE, thenendpoint_searchwith asearchQuerysjoin body onOrganizationEndpointVulnerabilities."List endpoints with critical missing patches." →
org_endpoint_external_references_search(q=...patchSensitivityLevel.sensitivityLevelName=='Critical')."Get attack vectors and links for a vulnerability." →
vulnerability_attack_vectors_search_by_fields/vulnerability_links_search_by_fields(q=vulnerabilityId==<id>)."Show the recent event log." →
incident_event_filter(sort +analyticsEventCreatedAtNanorange)."Count active CVEs grouped by vulnerability." →
aggregation_search_group."Call an endpoint I don't have a tool for." →
vrx_request(method,path,query,body).
How tools are generated
The tool modules are generated from the vRx OpenAPI specification:
python scripts/generate_from_openapi.py "Reference Material/api-docs.json"This regenerates the modules under src/vrx_mcp/tools/_generated/ and the catalog at
docs/ENDPOINTS.md. The generated files are not hand-edited — to change a tool, edit the
generator (its OVERRIDES / MUTATING_OVERRIDES maps) and regenerate. Generation is
deterministic, so re-running it produces a byte-identical, reviewable diff.
The OpenAPI spec and other vRx reference material live in the Reference Material/
directory, which is gitignored (vendor/customer-proprietary material, not redistributed).
Key generator behavior:
Operations are grouped by OpenAPI controller tag into one module per domain.
Redundant GET/POST search twins are collapsed to a single tool (the POST/body form).
Each operation is classified mutating (
PUT/DELETE, or a non-searchPOST) or read (GET, or a search-stylePOST); mutating tools are hidden in read-only mode.
Development
.venv/Scripts/python -m pytest # full suite (httpx fully mocked; no live calls)
.venv/Scripts/python -m ruff check . # lint
.venv/Scripts/python scripts/generate_from_openapi.py "Reference Material/api-docs.json" # regenerateCI runs ruff + pytest on Python 3.10 / 3.11 / 3.12 (see .github/workflows/ci.yml).
Maintainers: see CONTRIBUTING.md for the release process.
License
Support
This is an unofficial, internal project. For vRx platform or API questions, contact Vicarius directly. For issues with this MCP server, open an issue on the GitHub repository.
Available Tools
89 toolsaggregation_groupC
aggregation · POST /aggregation/group — Group objects by stuff. Required: metricActionName, metricAnalyticsEventAction, q, from, size, group.
| Name | Required | Description | Default |
|---|---|---|---|
| metricActionName | No | query param metricActionName (str) | |
| metricAnalyticsEventAction | No | query param metricAnalyticsEventAction (str) | |
| q | No | query param q (str) | |
| sort | No | query param sort (str) | |
| sortOriginalModelFields | No | query param sortOriginalModelFields (str) | |
| includeOriginalDoc | No | query param includeOriginalDoc (bool) | |
| includeOriginalDocIdOnly | No | query param includeOriginalDocIdOnly (bool) | |
| includeAllNestedAggregations | No | query param includeAllNestedAggregations (bool) | |
| from_ | No | query param from (int) | |
| size | No | query param size (int) | |
| group | No | query param group (str) | |
| body | No | JSON request body |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, so description carries full burden. It fails to disclose behavioral traits such as whether this is a read or mutation operation, any side effects, or required permissions. The 'Required' claim contradicts the schema.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is very short and mostly contains the HTTP method and path. It is concise but at the expense of clarity and completeness.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (12 parameters, no output schema), the description is insufficient. It does not explain return values, supported groupings, or behavior differences from sibling tools.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with minimal descriptions. The description lists some parameters but incorrectly marks them as required, and adds no additional semantic value beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states 'Group objects by stuff' which is extremely vague and does not specify what kind of objects or grouping. It also lists required parameters that are actually optional according to the schema, adding confusion.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives like aggregation_search_group. The description does not provide any context for selection.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
aggregation_search_groupC
aggregation · POST /aggregation/searchGroup — Group objects by stuff. Required: objectName, q, from, size, group.
| Name | Required | Description | Default |
|---|---|---|---|
| objectName | No | query param objectName (str) | |
| q | No | query param q (str) | |
| sort | No | query param sort (str) | |
| includeOriginalDoc | No | query param includeOriginalDoc (bool) | |
| excludeFields | No | query param excludeFields (str) | |
| includeFields | No | query param includeFields (str) | |
| sumLastSubAggregationBuckets | No | query param sumLastSubAggregationBuckets (int) | |
| subAggregationLevel | No | query param subAggregationLevel (int) | |
| newParser | No | query param newParser (bool) | |
| minDocCount | No | query param minDocCount (int) | |
| from_ | No | query param from (int) | |
| size | No | query param size (int) | |
| group | No | query param group (str) | |
| totalBy | No | query param totalBy (str) | |
| aggrUseMaxSize | No | query param aggrUseMaxSize (bool) | |
| body | No | JSON request body |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description should disclose behavioral traits but only provides the HTTP method and endpoint. It does not mention authentication, rate limits, data mutation, or any side effects.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is very short and front-loads the endpoint, but it is informal and incomplete. It sacrifices clarity for brevity, making it minimally acceptable.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given 16 parameters, no output schema, and no annotations, the description provides almost no context. It does not explain the grouping behavior, response format, or parameter interactions, leaving the agent with insufficient information.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Although schema coverage is 100%, the description incorrectly claims that objectName, q, from, size, and group are required (schema shows all optional). It adds no additional meaning beyond the schema's parameter descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states 'Group objects by stuff' and lists required parameters, but it's vague about what exactly is being grouped and what the grouping entails. It fails to differentiate from sibling tool 'aggregation_group'.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives like 'aggregation_group' or other search tools. No context on prerequisites or when not to use it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
automation_deleteC
automation · DELETE /automation/delete — Disable instance of the object. Requires a JSON request body.
| Name | Required | Description | Default |
|---|---|---|---|
| body | No | JSON request body |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description 'Requires a JSON request body' contradicts the input schema where the body parameter is not required (default null). This inconsistency can mislead an agent. Additionally, no behavioral traits are disclosed beyond the action (disable), such as whether the operation is destructive, reversible, or if it triggers side effects.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is very short (two sentences), but the first sentence repeats the endpoint and method, which is redundant given the tool name and context. The second sentence delivers the core purpose. It is concise but could be restructured to front-load the action and omit the HTTP verb line.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description lacks completeness for a delete operation: it does not state what happens after disabling (e.g., return value, confirmation), whether the operation is reversible, or what identifier to pass. With no output schema and no annotations, the agent needs more context to use this tool correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The only parameter 'body' has a generic description 'JSON request body' in the schema, and the tool description adds no further meaning. It does not specify what fields the body should contain (e.g., an identifier for the automation instance). With 100% schema description coverage, the description adds minimal value, leaving agents to guess the required structure.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'Disable instance of the object' which conveys a delete operation for an automation. The method DELETE and sibling tool names (automation_insert, automation_update) reinforce that this is a CRUD delete. However, the term 'Disable' is ambiguous (soft delete vs hard delete), and the description does not explicitly mention 'automation'.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool vs alternatives like automation_update or automation_search. There is no mention of prerequisites, such as requiring the automation ID in the body, or when not to use it (e.g., if the automation is already disabled).
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
automation_insertC
automation · PUT /automation/insert — insert instance of the object Requires a JSON request body.
| Name | Required | Description | Default |
|---|---|---|---|
| body | No | JSON request body |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations are absent, so the description bears the burden of disclosing behavior. It only states 'Requires a JSON request body', which is already in the schema. No information on side effects, auth requirements, rate limits, or success/failure behavior is given.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is very short (one sentence) and front-loaded with the tool's purpose. It includes the HTTP method and path, which may be helpful. There is no unnecessary information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the lack of annotations and output schema, the description is insufficient. It does not explain return values, error handling, or what specifically gets inserted. For a mutation tool, more context is needed.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description repeats the schema's parameter description ('JSON request body') without adding any extra meaning, such as expected structure, constraints, examples, or optional fields. With schema coverage at 100%, the description adds no value.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states 'insert instance of the object', indicating a verb (insert) and resource (object), clearly distinguishing it from sibling tools like automation_delete or automation_update. However, 'the object' is somewhat vague without specifying the automation context.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives like automation_update or automation_delete. There is no mention of prerequisites, conditions, or scenarios.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
automations_automationsC
automations · GET /v1/automations — Returns list of automations
| Name | Required | Description | Default |
|---|---|---|---|
| from_ | No | query param from (int) | |
| size | No | query param size (int) | |
| sort | No | query param sort (str) | |
| dateFrom | No | query param dateFrom (int) | |
| dateTo | No | query param dateTo (int) | |
| automationNextExecutionTimeFrom | No | query param automationNextExecutionTimeFrom (int) | |
| automationNextExecutionTimeTo | No | query param automationNextExecutionTimeTo (int) | |
| automationTypeIn | No | query param automationTypeIn (Any) | |
| automationTypeNotIn | No | query param automationTypeNotIn (Any) | |
| automationStateNames | No | query param automationStateNames (Any) | |
| automationStepActionsIn | No | query param automationStepActionsIn (Any) | |
| automationStepActionsNotIn | No | query param automationStepActionsNotIn (Any) | |
| automationIsActive | No | query param automationIsActive (bool) | |
| automationName | No | query param automationName (str) | |
| automationIdIn | No | query param automationIdIn (Any) | |
| automationIdNotIn | No | query param automationIdNotIn (Any) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries full burden for behavioral disclosure. It fails to mention pagination behavior, default size, authentication requirements, or any side effects. The minimal description does not compensate for the absence of annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is very short and front-loaded with the purpose. However, it includes the HTTP method and path which is somewhat redundant. Overall it is concise but could be more structured by summarizing key capabilities.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the 16 optional parameters, lack of output schema, and no annotations, the description is highly incomplete. It does not explain pagination, default values, or the response structure, leaving significant gaps for an AI agent to use the tool correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all 16 parameters. The description adds no additional meaning beyond what the schema provides, warranting the baseline score of 3.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it returns a list of automations and includes the HTTP method and path. However, given multiple sibling listing tools (automations_automations_1, etc.), it does not differentiate itself, leaving ambiguity about which specific list variant this is.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives like automation_search or automation_search_by_fields. The description simply states it returns a list, with no mention of context, prerequisites, or exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
automations_automations_1C
automations · POST /v1/automations — Inserts automation Requires a JSON request body.
| Name | Required | Description | Default |
|---|---|---|---|
| body | No | JSON request body |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries full burden. It only says 'Inserts automation' without disclosing side effects, permissions, idempotency, or any constraints beyond requiring a body.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is overly terse at one sentence. While it front-loads the method and endpoint, it could be more informative without sacrificing conciseness.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the lack of output schema and annotations, the description should explain expected body fields or response. It fails to provide sufficient context for an AI agent to use effectively.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% but the description adds no extra meaning beyond the schema's 'JSON request body'. Baseline 3 applies as no additional semantics provided.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool inserts an automation via POST. However, it does not differentiate from sibling tools like 'automation_insert' or 'automations_automations_2', which also likely insert automations.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives. The only hint is 'Requires a JSON request body', which is a requirement, not a usage context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
automations_automations_2C
automations · GET /v1/automations/{id} — Returns automation by id Required: id.
| Name | Required | Description | Default |
|---|---|---|---|
| id | Yes | path param id |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, and the description only states it returns an automation. It does not disclose error behavior, permissions, side effects, or any constraints beyond requiring an ID.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Extremely concise and front-loaded. It provides the essential information in a single line, with no wasted words. However, it could be slightly more informative while remaining concise.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple retrieval by ID with one parameter and no output schema, the description provides the minimum. But given the many similar sibling tools, more context would help the agent select the correct tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the parameter is fully described in the schema. The description adds no extra meaning beyond stating that 'id' is required, which is already in the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clearly states it returns an automation by ID using a GET endpoint. However, it does not differentiate from sibling tools like automations_automations or automations_automations_1, which may have similar purposes.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives. The description simply implies usage when an ID is available, but with many similar sibling tools, more explicit context is needed.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
automations_automations_3B
automations · PUT /v1/automations/{id} — Updates automation Required: id. Requires a JSON request body.
| Name | Required | Description | Default |
|---|---|---|---|
| id | Yes | path param id | |
| body | No | JSON request body |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries full burden. It mentions required fields (id, JSON body) but discloses no behavioral traits such as partial vs full update, error handling, permissions, or side effects. The agent lacks critical information for safe use.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is very concise at 12 words, front-loaded with the tool category 'automations'. It includes essential info (HTTP method, path, action) without fluff. Could be slightly better structured but effective for quick scanning.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the complexity (2 params, no output schema) and a large set of sibling tools, the description lacks usage context, behavioral details, and parameter specifics needed to fully understand the tool's role. It is inadequate for an AI agent to select and invoke correctly among many automation tools.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so baseline is 3. The description adds 'Required: id' and 'Requires a JSON request body', but the schema defines body as optional (anyOf: {} or null, default null). This creates a minor inconsistency but still adds some context. No additional parameter details beyond schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'Updates automation' and provides the HTTP method PUT and path pattern, making the tool's purpose unmistakable. It distinguishes itself from sibling tools like automation_delete or automation_insert.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives. Sibling tools exist for insert, delete, search, and state updates, but the description offers no context about when an update is appropriate or what the differences are.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
automation_searchC
automation · POST /automation/search — Returns events Required: q, from, size.
| Name | Required | Description | Default |
|---|---|---|---|
| q | No | query param q (str) | |
| sort | No | query param sort (str) | |
| group | No | query param group (str) | |
| from_ | No | query param from (int) | |
| size | No | query param size (int) | |
| includeFields | No | query param includeFields (str) | |
| body | No | JSON request body |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, and the description only states 'Returns events' without disclosing any behavioral traits like idempotency, permissions, or side effects. The required parameters claim is also unsubstantiated by the schema.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is very short and front-loaded, but it omits essential information such as return format and usage context, making it insufficiently concise.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no output schema and many sibling tools, the description fails to provide a complete picture. It does not describe the response structure, pagination, or differentiate from similar search tools.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Although schema description coverage is 100%, the description incorrectly claims 'Required: q, from, size' while the schema lists no required parameters. This misleading statement adds confusion rather than clarity.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly indicates the tool is for searching automation events, specifying the HTTP method and path. However, it does not differentiate from sibling tools like automation_search_all or automation_search_by_fields.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives such as automation_search_all or automation_search_by_fields. The description provides no context for selection.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
automation_search_allC
automation · POST /automation/searchAll — Returns events Required: q, from, size.
| Name | Required | Description | Default |
|---|---|---|---|
| q | No | query param q (str) | |
| sort | No | query param sort (str) | |
| group | No | query param group (str) | |
| from_ | No | query param from (int) | |
| size | No | query param size (int) | |
| includeFields | No | query param includeFields (str) | |
| body | No | JSON request body |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are present, and the description does not disclose behavioral traits such as pagination, rate limits, or idempotency. It only says 'Returns events' without further detail.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is very short but includes the endpoint and a note on required parameters (which is misleading). It could be more structured and informative.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the 7 parameters, no output schema, and many sibling tools, the description is incomplete. It does not explain output format, pagination, or parameter usage.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema descriptions are trivial (e.g., 'query param q (str)'), and the description adds no meaningful semantics. It mentions q, from, size as required, but the schema shows them as optional with defaults, creating a contradiction.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states it returns events via POST /automation/searchAll, but it does not specify what kind of events or how it differs from sibling tools like automation_search or automation_search_by_fields. The purpose is vaguely clear but not precise.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives. There is no mention of context, prerequisites, or exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
automation_search_by_fieldsC
automation · POST /automation/searchByFields — Get object by connection. Required: from, size, q.
| Name | Required | Description | Default |
|---|---|---|---|
| from_ | No | query param from (int) | |
| size | No | query param size (int) | |
| enabled | No | query param enabled (bool) | |
| addCount | No | query param addCount (bool) | |
| q | No | query param q (str) | |
| sort | No | query param sort (str) | |
| groupBy | No | query param groupBy (str) | |
| includeFields | No | query param includeFields (Any) | |
| body | No | JSON request body |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries full burden but only gives HTTP method and required params. No disclosure of side effects, auth, rate limits, or error behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Very short, but includes redundant HTTP method. Could be better organized to frontload the primary purpose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With 9 parameters, no output schema, and no annotations, the description covers almost nothing. Omits most parameters and response behavior.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description claims from, size, q are required, but the schema defines them as optional. This contradiction hurts reliability. Minimal value added beyond schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description only states 'Get object by connection' which is vague and does not specify what object (automation?) or connection. It does not distinguish from sibling tools like automation_search.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives like automation_search or automation_search_all. The description is purely operational.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
automations_update_stateC
automations · PUT /v1/automations/{id}/updateState — Updates automation state Required: id. Requires a JSON request body.
| Name | Required | Description | Default |
|---|---|---|---|
| id | Yes | path param id | |
| body | No | JSON request body |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description should disclose behavioral traits. It only states the action without mentioning side effects, required permissions, or whether the operation is reversible. The description adds minimal transparency.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise, consisting of one sentence that front-loads the method and path. However, it could benefit from slightly more detail without sacrificing conciseness.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with 2 parameters and no output schema, the description is incomplete. It does not specify what the JSON body should contain, which is critical for correct invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Although schema coverage is 100%, the description of the 'body' parameter as 'JSON request body' is vague. The description does not clarify the expected structure or allowed values, adding little beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool updates automation state, specifying the resource and action. However, it lacks detail on what state values are possible, which could clarify its purpose further.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus sibling tools like automation_update or automation_search. The description does not indicate prerequisites or alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
automation_task_templates_delete_manyD
automation_task_templates · DELETE /automationTaskTemplates/deleteMany — Disable instance of the objects. Required: q. Requires a JSON request body.
| Name | Required | Description | Default |
|---|---|---|---|
| q | No | query param q (str) | |
| body | No | JSON request body |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided. The description says 'Disable' but the HTTP method is DELETE, which is contradictory and unclear. No information about side effects, permissions, or whether the operation is reversible. The description fails to disclose essential behavioral traits.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is short but unclear and poorly structured. It repeats the tool name and HTTP method, which are already in the title. The sentence tries to convey too much in a single line without proper separation of concerns.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No output schema is present. The description does not explain what the tool returns, how deletions are handled (soft vs hard), or any limits (e.g., batch size). For a 'delete many' operation, this is critically incomplete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema has 100% coverage for two parameters (q and body). The description adds minimal value by stating 'Required: q' and 'Requires a JSON request body', but this contradicts the schema where both parameters are optional (default null). This creates confusion rather than clarity.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states 'Disable instance of the objects' which is ambiguous—does it disable or delete? The HTTP method DELETE suggests deletion, but the word 'disable' is confusing. There is no differentiation from sibling delete tools like 'endpoint_delete_many' or 'user_invitation_delete'.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives. No prerequisites, context, or exclusions provided. The description only states 'Required: q' but the schema shows q is optional, adding confusion.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
automation_task_templates_insertC
automation_task_templates · PUT /automationTaskTemplates/insert — Insert instance of the object Requires a JSON request body.
| Name | Required | Description | Default |
|---|---|---|---|
| body | No | JSON request body |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden. It only repeats that a JSON body is required; it does not disclose success behaviors, error conditions, permissions, or side effects. For an insert operation, critical context is missing.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise (one sentence) but lacks structure. It includes redundant HTTP method and path information. While not overly verbose, it sacrifices clarity for brevity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity and the abundance of sibling tools, the description is too sparse. It provides no context about the response, error handling, or typical use cases, which would help an agent choose correctly among similar tools.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description adds no meaning beyond the input schema: both say 'JSON request body'. Schema coverage is 100% but the description merely echoes the schema, providing no additional semantics about the body's structure or required fields.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states 'Insert instance of the object' which is clear but vague; it relies on the tool name to specify the object type. It does not distinguish from similar sibling tools like 'automation_insert' or 'task_template_insert', making it hard for an agent to differentiate.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool vs alternatives like 'automation_insert' or 'task_template_insert'. The only additional information is 'Requires a JSON request body', which is obvious from the input schema.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
automation_task_templates_insert_manyC
automation_task_templates · PUT /automationTaskTemplates/insertMany — Inserte instance of the object Requires a JSON request body.
| Name | Required | Description | Default |
|---|---|---|---|
| body | No | JSON request body |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided. Description only mentions 'Requires a JSON request body' without specifying required fields, error behavior, or idempotency. Insufficient transparency for a mutation operation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is short but contains redundancy (name and endpoint repeated) and a misspelling ('Inserte'). It is not well-structured or front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a many-insert tool with no output schema and no annotations, the description is incomplete. It lacks information about response format, error codes, or how to provide multiple objects.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Only one parameter 'body' with schema description 'JSON request body'. Schema coverage is 100%, so baseline 3 is appropriate. Description adds no additional meaning or details about the body structure.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states 'Inserte instance of the object' which is a misspelling and implies singular insertion, conflicting with the tool name '_insert_many'. The purpose is vague and not differentiated from sibling tools like 'automation_task_templates_insert' (singular).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus the singular insert or other alternatives. Missing context such as batch size limits or prerequisites.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
automation_updateC
automation · POST /automation/update — Update instance of the object Requires a JSON request body.
| Name | Required | Description | Default |
|---|---|---|---|
| body | No | JSON request body |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations exist. The description only mentions 'Update' and 'Requires a JSON request body', but does not disclose idempotency, error responses, permissions, or side effects. This leaves the agent uninformed about behavioral traits.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is very short, but includes unnecessary technical details like the HTTP method and endpoint path. It is not well-structured for an AI agent, lacking front-loaded clarity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No output schema, no annotations, and a sparse description. The tool concept (update) is broad, and the description fails to cover what specific fields can be updated, constraints, or potential impact on the system.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with the 'body' parameter described as 'JSON request body'. The description adds no meaning beyond the schema, merely restating that a JSON body is required. No benefit over structured data.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states 'Update instance of the object' which identifies a verb and resource, but fails to specify which object type (e.g., automation). Among siblings like 'automations_update_state' and 'automation_delete', the lack of specificity reduces clarity.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives such as 'automations_update_state' or 'task_template_update'. No prerequisites or context for invocation are provided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
date_get_current_dateA
date · GET /date/getCurrentDate — Get current date.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided. The description only says 'Get current date' without specifying timezone, format, or caching behavior. This leaves the agent guessing about important behavioral details for a date retrieval tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise, consisting of a single sentence. No extraneous information is present, and it is front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with no parameters and no output schema, the description is adequate but could be improved by noting the expected output format or timezone. It is complete enough for a simple use case.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
There are no parameters (0), so schema description coverage is 100%. The description adds no parameter information, which is acceptable since there are none. Baseline score of 4 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'Get current date' with a specific verb and resource. It distinguishes the tool from siblings, as none of the sibling tools appear to retrieve the current date.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage through its purpose, but provides no explicit when-to-use, when-not-to-use, or alternatives. Since the tool is simple, further guidance is minimal but absent.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
endpoint_attributes_searchC
endpoint_attributes · POST /endpointAttributes/search — Returns events Required: q, from, size.
| Name | Required | Description | Default |
|---|---|---|---|
| q | No | query param q (str) | |
| sort | No | query param sort (str) | |
| group | No | query param group (str) | |
| from_ | No | query param from (int) | |
| size | No | query param size (int) | |
| includeFields | No | query param includeFields (str) | |
| body | No | JSON request body |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description only says 'Returns events' with no details on pagination, authentication, or side effects. It also inaccurately marks q, from, size as required (schema shows optional), which could mislead. No annotations to compensate.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is very short (one sentence) and front-loaded with endpoint, but it lacks essential information. It is not appropriately sized for the tool's complexity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, no annotations, and 7 parameters, the description is grossly incomplete. It does not explain return format, filtering behavior, or the purpose of parameters like group, sort, body, includeFields.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema covers all 7 parameters with descriptions, so baseline is 3. However, the description incorrectly states that q, from, size are required, while schema shows optional. This adds confusion and reduces value.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states the tool returns events and gives the endpoint URL. However, 'events' is vague and does not differentiate from sibling search tools for other entities. The meaning is partially clear but lacks specificity.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives like endpoint_search or automation_search. No prerequisites or context for usage are provided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
endpoint_attributes_search_by_fieldsC
endpoint_attributes · POST /endpointAttributes/searchByFields — Get object by connection. Required: from, size, q.
| Name | Required | Description | Default |
|---|---|---|---|
| from_ | No | query param from (int) | |
| size | No | query param size (int) | |
| enabled | No | query param enabled (bool) | |
| addCount | No | query param addCount (bool) | |
| q | No | query param q (str) | |
| sort | No | query param sort (str) | |
| groupBy | No | query param groupBy (str) | |
| includeFields | No | query param includeFields (Any) | |
| body | No | JSON request body |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided. The description does not disclose behavioral traits such as whether it is read-only, pagination behavior, or side effects. It only mentions the HTTP method and path.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence, concise but unclear. Includes unnecessary jargon ('Get object by connection') that reduces clarity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given 9 parameters and no output schema, the description does not explain return values or the purpose of the search. Incomplete for effective tool selection.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, but descriptions are minimal ('query param ...'). The description adds only a misleading claim about required parameters, no meaningful semantics beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states it is a search operation to 'get object by connection,' but does not define what an attribute or connection is. It vaguely indicates a search without differentiating from sibling search tools like 'endpoint_attributes_search' or 'endpoint_search.'
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It claims 'Required: from, size, q' but the schema lists no required parameters. No guidance on when to use this tool versus alternatives. Misleading about required fields.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
endpoint_deleteC
endpoint · DELETE /endpoint/delete — Disable instance of the object. Requires a JSON request body.
| Name | Required | Description | Default |
|---|---|---|---|
| body | No | JSON request body |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description says it disables a tool and requires a JSON request body, but it doesn't disclose side effects, requirements, or what happens upon execution. There is a contradiction with the schema: the description claims body is required, but the schema has default null, making it optional. No annotations exist to mitigate this.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is very concise, but it includes unnecessary REST-like prefix text that may confuse. It is short but sacrifices clarity; it could be better structured with a clear purpose and parameter hint.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no output schema and a single parameter with a vague description, the tool is incomplete. It does not explain the return format, side effects, or how to specify the target endpoint, making it insufficient for an agent to use correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The only parameter 'body' is described as 'JSON request body', which is a tautology from the schema. The description adds no semantic value about what the body should contain (e.g., an endpoint identifier), leaving the agent without meaningful guidance.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states it disables an instance of the object and specifies the HTTP method, but the term 'Disable' is ambiguous and doesn't match the tool name 'delete'. It lacks specificity about what object is being acted upon, making it only moderately clear.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus sibling tools like endpoint_delete_many. No prerequisites or context for appropriate usage are provided, leaving the agent to infer without support.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
endpoint_delete_manyC
endpoint · DELETE /endpoint/deleteMany — Disable instance of the objects. Required: q. Requires a JSON request body.
| Name | Required | Description | Default |
|---|---|---|---|
| q | No | query param q (str) | |
| body | No | JSON request body |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description contradicts the schema by stating 'Required: q' while the schema marks q as optional with a default of null. No annotations are provided. The term 'Disable instance' is ambiguous and does not clarify if the action is destructive or reversible.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is short but includes redundant elements like 'endpoint ·' and repeats information from the schema. It is not efficiently structured for clarity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no annotations or output schema, the description lacks critical details: what 'q' represents, how to specify which instances to delete, the response format, and whether 'disable' means soft or hard delete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema already describes both parameters (q as a string query param, body as JSON). The description adds 'Required: q' which is misleading. No additional meaning is provided beyond the schema, and the contradiction reduces reliability.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states the HTTP method and path, and vaguely indicates disabling instances, but does not clearly say it deletes multiple endpoints. It also fails to differentiate from the sibling 'endpoint_delete' tool.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives. The description mentions 'Required: q' but does not explain what q is or provide context for appropriate usage.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
endpoint_searchB
Search endpoints (assets). RSQL q filter, e.g. q=endpointName=='HOST01'. size<=500, from<=10000; use sort + seek paging beyond 10000. Required: q, from, size.
| Name | Required | Description | Default |
|---|---|---|---|
| q | No | query param q (str) | |
| sort | No | query param sort (str) | |
| group | No | query param group (str) | |
| from_ | No | query param from (int) | |
| size | No | query param size (int) | |
| includeFields | No | query param includeFields (str) | |
| body | No | JSON request body |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description discloses paging behavior (size <= 500, from <= 10000) and mentions sort for deeper paging. However, it makes a claim that q, from, size are required, contradicting the schema where all parameters are optional (nullable). No information about authorization, rate limits, or side effects is provided, and annotations are absent.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is very concise, consisting of just two sentences that convey the core functionality, filter format, and paging constraints. Every sentence adds essential information without redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description covers the main filtering and paging aspects but lacks details on other parameters (group, includeFields, body) and the response structure. Since there is no output schema, more context about return values would be beneficial for complete understanding.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description adds significant value beyond the schema by explaining the RSQL filter syntax with an example and specifying constraints on size and from. It also hints at using sort and seek paging, which aids understanding of the 'sort' parameter even though schema coverage is 100%.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it is for searching endpoints/assets, provides an example RSQL query, and mentions paging limits. However, it does not differentiate from sibling tools like endpoint_attributes_search, which also search endpoints but on different attributes.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly states 'Required: q, from, size' and advises using sort + seek paging beyond 10000, giving some usage guidance. However, it does not explain when to use this tool over alternatives or when not to use it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
endpoint_vulnerability_countC
endpoint_vulnerability · GET /endpointVulnerability/count — Count objects by stuff. Required: q, searchQuerys. Allowed values: analyticsEventAction=AttributeAdded|CustomAttributeAdded|OperatingSystemFamilyAdded|OperatingSystemFamilyPathsAdded|FunctionContainerArtifactPathAdded|UserActivatedAccount|UserAdded|OrganizationInstallationsAdded|UserActivity|IncidentEvent|NotificationIncidentEvent|InsightEvent|InternalServerAttributeScan|InternalServerAttributeScanEndpoints|ApplicationConfigEntryAdded|PublisherAdded|ApplicationAdded|EndpointAdded|ArchitectureAdded|FetchApplicationConfigWithCustomizedLocationFailed|FetchApplicationConfigWithCustomizedLocationSucceed|NotificationSourceAdded|OperatingSystemAdded|ProfilePictureAdded|VulnerabilityAdded|PatchAdded|ProfilePictureFailTooLarge|ProfilePictureFailOnUpload|UpdatedDevices|FetchDevices|NotificationsSentToDevice|NotificationsTrack|FetchNotificationById|ExternalReferenceSourceAdded|ExternalReferenceAdded|ExternalReferenceDisabled|UserAddedPassword|UserChangedPassword|UserForgotPassword|OrganizationAdded|UserAuthenticatedPassword|UserResetPassword|FunctionContainerArtifactAdded|FunctionContainerAdded|CapabilityAdded|OrganizationEndpointPublisherProductProcessesAdded|OrganizationExternalReferenceSourceAdded|PublisherProductCapabilityFunctionsAdded|StatusCheckAdded|CommandAdded|OrganizationEndpointFingerprintAdded|CPEStructureAdded|CPEStructureStatusAdded|CheckAdded|LinkAdded|TagAdded|InternalTagAdded|AttackVectorAdded|CheckCommandsAdded|HashtagAdded|OrganizationHashtagAdded|InternalServerAdded|TaskAdded|TaskEndpointsEventsAdded|OrganizationConfigEntryAdded|OrganizationEndpointConfigEntryAdded|OrganizationEndpointPatchPatchPackagesEntryAdded|OrganizationEndpointAutomationsEntryAdded|OrganizationEndpointLogsAdded|LicenseAgreementAdded|ProductRawEntryAdded|PrivacyPolicyAgreementAdded|UserPrivacyPolicyAgreementAdded|OrganizationEndpointGroup|RuleAdded|PathAdded|OrganizationEndpointPublisherProductProcessInternalTags|ScriptTemplateAdded|AutomationAdded|RoleAdded|ResourceAdded|PrivilegeAdded|RoleResourcePrivilegesAdded|OrganizationTeamAdded|PatchPackageXpatch|AuditLogs|BenchmarkResult|BenchmarkCheckResult|EndpointVulnerabilityEvidence|EndpointVulnerability|CPEInfoEvent|IntegrationAction.
| Name | Required | Description | Default |
|---|---|---|---|
| q | No | query param q (str) | |
| analyticsEventAction | No | query param analyticsEventAction (str) | |
| searchQuerys | No | query param searchQuerys (Any) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description lists allowed values for analyticsEventAction, which adds behavioral detail. However, it incorrectly claims that q and searchQuerys are required (contradicting the schema), which reduces trust and transparency. With no annotations, the burden is on the description, and this contradiction is a significant flaw.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description includes a long list of allowed values, which could be better placed in the schema. The core part is concise but vague ('stuff'). The structure is messy, mixing endpoint, purpose, and parameter notes without clear organization.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool has no output schema, so the description should explain the return value. It does not. The description also fails to clarify the contradiction about required parameters, leaving the agent without complete context for invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline is 3. The description adds the allowed values for analyticsEventAction, which is useful. But it mislabels q and searchQuerys as required, which is misleading and detracts from semantic clarity.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description vaguely states 'Count objects by stuff,' which is uninformative. It identifies it as a count operation but fails to specify what objects or criteria, making it difficult for an agent to understand the tool's exact purpose.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives like endpoint_vulnerability_count_1. The description does not mention any contextual constraints or prerequisites.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
endpoint_vulnerability_count_1D
endpoint_vulnerability · POST /endpointVulnerability/count — Count objects by stuff. Required: q. Allowed values: analyticsEventAction=AttributeAdded|CustomAttributeAdded|OperatingSystemFamilyAdded|OperatingSystemFamilyPathsAdded|FunctionContainerArtifactPathAdded|UserActivatedAccount|UserAdded|OrganizationInstallationsAdded|UserActivity|IncidentEvent|NotificationIncidentEvent|InsightEvent|InternalServerAttributeScan|InternalServerAttributeScanEndpoints|ApplicationConfigEntryAdded|PublisherAdded|ApplicationAdded|EndpointAdded|ArchitectureAdded|FetchApplicationConfigWithCustomizedLocationFailed|FetchApplicationConfigWithCustomizedLocationSucceed|NotificationSourceAdded|OperatingSystemAdded|ProfilePictureAdded|VulnerabilityAdded|PatchAdded|ProfilePictureFailTooLarge|ProfilePictureFailOnUpload|UpdatedDevices|FetchDevices|NotificationsSentToDevice|NotificationsTrack|FetchNotificationById|ExternalReferenceSourceAdded|ExternalReferenceAdded|ExternalReferenceDisabled|UserAddedPassword|UserChangedPassword|UserForgotPassword|OrganizationAdded|UserAuthenticatedPassword|UserResetPassword|FunctionContainerArtifactAdded|FunctionContainerAdded|CapabilityAdded|OrganizationEndpointPublisherProductProcessesAdded|OrganizationExternalReferenceSourceAdded|PublisherProductCapabilityFunctionsAdded|StatusCheckAdded|CommandAdded|OrganizationEndpointFingerprintAdded|CPEStructureAdded|CPEStructureStatusAdded|CheckAdded|LinkAdded|TagAdded|InternalTagAdded|AttackVectorAdded|CheckCommandsAdded|HashtagAdded|OrganizationHashtagAdded|InternalServerAdded|TaskAdded|TaskEndpointsEventsAdded|OrganizationConfigEntryAdded|OrganizationEndpointConfigEntryAdded|OrganizationEndpointPatchPatchPackagesEntryAdded|OrganizationEndpointAutomationsEntryAdded|OrganizationEndpointLogsAdded|LicenseAgreementAdded|ProductRawEntryAdded|PrivacyPolicyAgreementAdded|UserPrivacyPolicyAgreementAdded|OrganizationEndpointGroup|RuleAdded|PathAdded|OrganizationEndpointPublisherProductProcessInternalTags|ScriptTemplateAdded|AutomationAdded|RoleAdded|ResourceAdded|PrivilegeAdded|RoleResourcePrivilegesAdded|OrganizationTeamAdded|PatchPackageXpatch|AuditLogs|BenchmarkResult|BenchmarkCheckResult|EndpointVulnerabilityEvidence|EndpointVulnerability|CPEInfoEvent|IntegrationAction.
| Name | Required | Description | Default |
|---|---|---|---|
| q | No | query param q (str) | |
| analyticsEventAction | No | query param analyticsEventAction (str) | |
| body | No | JSON request body |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, and the description does not disclose behavioral traits such as authentication requirements, rate limits, or side effects. It only lists allowed values for one parameter.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a long run-on sentence with a massive enumeration, making it hard to parse. Important information is buried, and the structure is poor.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Without an output schema and with many sibling tools, the description fails to explain what the output represents, how to use filters, or the purpose of the 'body' parameter. It is incomplete for effective use.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
While schema coverage is 100%, the description adds a list of allowed values for 'analyticsEventAction'. However, it incorrectly states 'Required: q' despite the schema showing 'q' as optional with a default of null. This contradiction reduces reliability.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states 'Count objects by stuff', which is vague and doesn't specify that it counts endpoint vulnerabilities. The tool name suggests endpoint vulnerability, but the description fails to confirm this. It lacks a specific verb and resource.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives like 'endpoint_vulnerability_count'. There is no mention of context, prerequisites, or exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
endpoint_vulnerability_filterA
endpoint_vulnerability · POST /endpointVulnerability/filter — Returns events Required: q, from, size. Allowed values: analyticsEventAction=AttributeAdded|CustomAttributeAdded|OperatingSystemFamilyAdded|OperatingSystemFamilyPathsAdded|FunctionContainerArtifactPathAdded|UserActivatedAccount|UserAdded|OrganizationInstallationsAdded|UserActivity|IncidentEvent|NotificationIncidentEvent|InsightEvent|InternalServerAttributeScan|InternalServerAttributeScanEndpoints|ApplicationConfigEntryAdded|PublisherAdded|ApplicationAdded|EndpointAdded|ArchitectureAdded|FetchApplicationConfigWithCustomizedLocationFailed|FetchApplicationConfigWithCustomizedLocationSucceed|NotificationSourceAdded|OperatingSystemAdded|ProfilePictureAdded|VulnerabilityAdded|PatchAdded|ProfilePictureFailTooLarge|ProfilePictureFailOnUpload|UpdatedDevices|FetchDevices|NotificationsSentToDevice|NotificationsTrack|FetchNotificationById|ExternalReferenceSourceAdded|ExternalReferenceAdded|ExternalReferenceDisabled|UserAddedPassword|UserChangedPassword|UserForgotPassword|OrganizationAdded|UserAuthenticatedPassword|UserResetPassword|FunctionContainerArtifactAdded|FunctionContainerAdded|CapabilityAdded|OrganizationEndpointPublisherProductProcessesAdded|OrganizationExternalReferenceSourceAdded|PublisherProductCapabilityFunctionsAdded|StatusCheckAdded|CommandAdded|OrganizationEndpointFingerprintAdded|CPEStructureAdded|CPEStructureStatusAdded|CheckAdded|LinkAdded|TagAdded|InternalTagAdded|AttackVectorAdded|CheckCommandsAdded|HashtagAdded|OrganizationHashtagAdded|InternalServerAdded|TaskAdded|TaskEndpointsEventsAdded|OrganizationConfigEntryAdded|OrganizationEndpointConfigEntryAdded|OrganizationEndpointPatchPatchPackagesEntryAdded|OrganizationEndpointAutomationsEntryAdded|OrganizationEndpointLogsAdded|LicenseAgreementAdded|ProductRawEntryAdded|PrivacyPolicyAgreementAdded|UserPrivacyPolicyAgreementAdded|OrganizationEndpointGroup|RuleAdded|PathAdded|OrganizationEndpointPublisherProductProcessInternalTags|ScriptTemplateAdded|AutomationAdded|RoleAdded|ResourceAdded|PrivilegeAdded|RoleResourcePrivilegesAdded|OrganizationTeamAdded|PatchPackageXpatch|AuditLogs|BenchmarkResult|BenchmarkCheckResult|EndpointVulnerabilityEvidence|EndpointVulnerability|CPEInfoEvent|IntegrationAction.
| Name | Required | Description | Default |
|---|---|---|---|
| q | No | query param q (str) | |
| sort | No | query param sort (str) | |
| analyticsEventAction | No | query param analyticsEventAction (str) | |
| excludeFields | No | query param excludeFields (str) | |
| includeFields | No | query param includeFields (str) | |
| includeOriginalDoc | No | query param includeOriginalDoc (bool) | |
| getLegacyData | No | query param getLegacyData (bool) | |
| from_ | No | query param from (int) | |
| size | No | query param size (int) | |
| body | No | JSON request body |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must carry full burden. It discloses the HTTP method and return type but does not mention rate limits, authentication, side effects, or response format. The list of allowed values adds some transparency, but overall lacks depth for a POST endpoint.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single string that front-loads the purpose, method, and path, then lists required parameters and allowed values. The large list of allowed values is necessary but makes it lengthy. It is efficient and packs essential info, though could be better structured (e.g., bullet points).
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With 10 parameters, no output schema, and no annotations, the description covers purpose, required params, and allowed values. It does not explain the body parameter, sorting, pagination, or response format. Adequate for basic use but lacks completeness for a complex filtering tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with basic descriptions. The description adds value by listing required parameters (q, from, size) and enumerating all allowed values for analyticsEventAction, which is not in the schema. However, note the schema marks these as optional (default null), so the 'required' claim may be inconsistent.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states that the tool returns events, provides the HTTP method POST and path /endpointVulnerability/filter, and lists required parameters and allowed values for analyticsEventAction. This is specific and distinct from sibling tools like endpoint_vulnerability_count.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description mentions required parameters (q, from, size) and allowed values for analyticsEventAction, but does not explicitly guide when to use this tool versus alternatives like endpoint_vulnerability_count. The context is clear but lacks exclusions or comparative guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
external_reference_external_references_search_by_fieldsC
external_reference_external_references · POST /externalReferenceExternalReferences/searchByFields — Get object by connection. Required: from, size, q.
| Name | Required | Description | Default |
|---|---|---|---|
| from_ | No | query param from (int) | |
| size | No | query param size (int) | |
| enabled | No | query param enabled (bool) | |
| addCount | No | query param addCount (bool) | |
| q | No | query param q (str) | |
| sort | No | query param sort (str) | |
| groupBy | No | query param groupBy (str) | |
| includeFields | No | query param includeFields (Any) | |
| body | No | JSON request body |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Without annotations, the description should disclose behavioral traits. It only mentions the HTTP method and required params, lacking details on side effects, authentication, pagination limits, or return format.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is very short and front-loads the key information. No wasted words, but it omits necessary context for effective use.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given 9 parameters, no output schema, and no annotations, the description is insufficient. It fails to explain what 'by connection' means, pagination behavior, or how the tool fits with siblings.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3. The description adds that 'from, size, q' are required, which is useful but conflicts with schema defaults (all nullable). This adds marginal value.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states 'Get object by connection' and lists required parameters, clearly indicating it searches external references by fields. However, it doesn't differentiate from the sibling 'search_by_objects' despite the name hinting at the difference.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives. Only lists required parameters without context on use cases or exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
external_reference_external_references_search_by_objectsC
external_reference_external_references · POST /externalReferenceExternalReferences/searchByObjects — Get object by connection. Required: from, size, q. Requires a JSON request body.
| Name | Required | Description | Default |
|---|---|---|---|
| enabled | No | query param enabled (bool) | |
| from_ | No | query param from (int) | |
| size | No | query param size (int) | |
| q | No | query param q (str) | |
| body | No | JSON request body |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided. The description claims required parameters (from, size, q) and required JSON body, but the schema lists all parameters as optional, creating a contradiction. The behavior is not clearly disclosed beyond being a search.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Short description but includes redundant tool name and path. Could be more concise and structured. The list of required params is helpful but contradicts schema.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given 5 parameters and no output schema or annotations, the description is incomplete. It lacks explanation of the JSON body, the concept of 'connection', return values, pagination, and error handling.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, but descriptions are minimal (e.g., 'query param enabled (bool)'). The description adds value by highlighting required params, but this contradicts the schema. It does not explain the meaning of 'q' or 'enabled', only adding confusion.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states it is a search for objects by connection using POST, and lists required parameters. It distinguishes from the sibling 'external_reference_external_references_search_by_fields' by specifying 'by connection', but does not clarify what 'connection' means.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool vs alternatives like the sibling search by fields. It mentions required parameters but lacks context for appropriate usage.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
incident_event_countD
incident_event · GET /incidentEvent/count — Count objects by stuff. Required: q, searchQuerys. Allowed values: analyticsEventAction=AttributeAdded|CustomAttributeAdded|OperatingSystemFamilyAdded|OperatingSystemFamilyPathsAdded|FunctionContainerArtifactPathAdded|UserActivatedAccount|UserAdded|OrganizationInstallationsAdded|UserActivity|IncidentEvent|NotificationIncidentEvent|InsightEvent|InternalServerAttributeScan|InternalServerAttributeScanEndpoints|ApplicationConfigEntryAdded|PublisherAdded|ApplicationAdded|EndpointAdded|ArchitectureAdded|FetchApplicationConfigWithCustomizedLocationFailed|FetchApplicationConfigWithCustomizedLocationSucceed|NotificationSourceAdded|OperatingSystemAdded|ProfilePictureAdded|VulnerabilityAdded|PatchAdded|ProfilePictureFailTooLarge|ProfilePictureFailOnUpload|UpdatedDevices|FetchDevices|NotificationsSentToDevice|NotificationsTrack|FetchNotificationById|ExternalReferenceSourceAdded|ExternalReferenceAdded|ExternalReferenceDisabled|UserAddedPassword|UserChangedPassword|UserForgotPassword|OrganizationAdded|UserAuthenticatedPassword|UserResetPassword|FunctionContainerArtifactAdded|FunctionContainerAdded|CapabilityAdded|OrganizationEndpointPublisherProductProcessesAdded|OrganizationExternalReferenceSourceAdded|PublisherProductCapabilityFunctionsAdded|StatusCheckAdded|CommandAdded|OrganizationEndpointFingerprintAdded|CPEStructureAdded|CPEStructureStatusAdded|CheckAdded|LinkAdded|TagAdded|InternalTagAdded|AttackVectorAdded|CheckCommandsAdded|HashtagAdded|OrganizationHashtagAdded|InternalServerAdded|TaskAdded|TaskEndpointsEventsAdded|OrganizationConfigEntryAdded|OrganizationEndpointConfigEntryAdded|OrganizationEndpointPatchPatchPackagesEntryAdded|OrganizationEndpointAutomationsEntryAdded|OrganizationEndpointLogsAdded|LicenseAgreementAdded|ProductRawEntryAdded|PrivacyPolicyAgreementAdded|UserPrivacyPolicyAgreementAdded|OrganizationEndpointGroup|RuleAdded|PathAdded|OrganizationEndpointPublisherProductProcessInternalTags|ScriptTemplateAdded|AutomationAdded|RoleAdded|ResourceAdded|PrivilegeAdded|RoleResourcePrivilegesAdded|OrganizationTeamAdded|PatchPackageXpatch|AuditLogs|BenchmarkResult|BenchmarkCheckResult|EndpointVulnerabilityEvidence|EndpointVulnerability|CPEInfoEvent|IntegrationAction.
| Name | Required | Description | Default |
|---|---|---|---|
| q | No | query param q (str) | |
| analyticsEventAction | No | query param analyticsEventAction (str) | |
| searchQuerys | No | query param searchQuerys (Any) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must fully disclose behavioral traits. It does not indicate whether the operation is read-only, destructive, rate-limited, or permission-restricted. The description only states 'Count objects' without any behavioral context beyond the schema.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single cluttered block mixing endpoint path, vague purpose, and a long list of allowed values. It is not concise; the endpoint path is extraneous and the list should be separated. The structure does not front-load essential information for the agent.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given three parameters and no output schema, the description should explain what the count represents, how parameters affect results, and any constraints. It fails to provide a complete picture, omitting details like return format, behavior with missing parameters, and relationship to sibling tools.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Although schema description coverage is 100% with minimal descriptions, the description adds a long list of allowed values for analyticsEventAction, which is missing from the schema. However, it contains a contradiction (claiming required parameters where schema shows none) and the allowed values list is poorly formatted. The added value is marginal and partly misleading.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description 'Count objects by stuff' is vague and does not specify what kind of objects are counted. The tool name suggests incident events, but the description fails to clearly state that it counts incident events based on query parameters. The inclusion of the endpoint path adds some context but the purpose remains unclear.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus sibling count tools like incident_event_count_1. There is no differentiation or context about prerequisites or preferred use cases. The misleading claim about required parameters (q, searchQuerys) contradicts the schema and adds confusion.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
incident_event_count_1C
incident_event · POST /incidentEvent/count — Count objects by stuff. Required: q. Allowed values: analyticsEventAction=AttributeAdded|CustomAttributeAdded|OperatingSystemFamilyAdded|OperatingSystemFamilyPathsAdded|FunctionContainerArtifactPathAdded|UserActivatedAccount|UserAdded|OrganizationInstallationsAdded|UserActivity|IncidentEvent|NotificationIncidentEvent|InsightEvent|InternalServerAttributeScan|InternalServerAttributeScanEndpoints|ApplicationConfigEntryAdded|PublisherAdded|ApplicationAdded|EndpointAdded|ArchitectureAdded|FetchApplicationConfigWithCustomizedLocationFailed|FetchApplicationConfigWithCustomizedLocationSucceed|NotificationSourceAdded|OperatingSystemAdded|ProfilePictureAdded|VulnerabilityAdded|PatchAdded|ProfilePictureFailTooLarge|ProfilePictureFailOnUpload|UpdatedDevices|FetchDevices|NotificationsSentToDevice|NotificationsTrack|FetchNotificationById|ExternalReferenceSourceAdded|ExternalReferenceAdded|ExternalReferenceDisabled|UserAddedPassword|UserChangedPassword|UserForgotPassword|OrganizationAdded|UserAuthenticatedPassword|UserResetPassword|FunctionContainerArtifactAdded|FunctionContainerAdded|CapabilityAdded|OrganizationEndpointPublisherProductProcessesAdded|OrganizationExternalReferenceSourceAdded|PublisherProductCapabilityFunctionsAdded|StatusCheckAdded|CommandAdded|OrganizationEndpointFingerprintAdded|CPEStructureAdded|CPEStructureStatusAdded|CheckAdded|LinkAdded|TagAdded|InternalTagAdded|AttackVectorAdded|CheckCommandsAdded|HashtagAdded|OrganizationHashtagAdded|InternalServerAdded|TaskAdded|TaskEndpointsEventsAdded|OrganizationConfigEntryAdded|OrganizationEndpointConfigEntryAdded|OrganizationEndpointPatchPatchPackagesEntryAdded|OrganizationEndpointAutomationsEntryAdded|OrganizationEndpointLogsAdded|LicenseAgreementAdded|ProductRawEntryAdded|PrivacyPolicyAgreementAdded|UserPrivacyPolicyAgreementAdded|OrganizationEndpointGroup|RuleAdded|PathAdded|OrganizationEndpointPublisherProductProcessInternalTags|ScriptTemplateAdded|AutomationAdded|RoleAdded|ResourceAdded|PrivilegeAdded|RoleResourcePrivilegesAdded|OrganizationTeamAdded|PatchPackageXpatch|AuditLogs|BenchmarkResult|BenchmarkCheckResult|EndpointVulnerabilityEvidence|EndpointVulnerability|CPEInfoEvent|IntegrationAction.
| Name | Required | Description | Default |
|---|---|---|---|
| q | No | query param q (str) | |
| analyticsEventAction | No | query param analyticsEventAction (str) | |
| body | No | JSON request body |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, so description carries full burden. Only says 'Count objects by stuff' and lists allowed values, but no info on side effects, auth needs, or read-only nature.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Description is a single vague sentence followed by a huge list of allowed values. Not concise, poorly structured, and hard to parse.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Missing key context: what does 'stuff' mean? What does the body parameter do? Does not explain how to use the tool effectively or how it differs from many similar counting siblings.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema descriptions cover 100% of parameters with basic info. Description adds allowed values for analyticsEventAction, which is helpful, but also incorrectly claims q is required, reducing clarity.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description says 'Count objects by stuff,' which is vague and does not clearly state the tool's purpose. It does not differentiate from sibling tool 'incident_event_count' and other counting tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool vs alternatives like 'incident_event_count' or 'incident_event_filter'. Misstates 'Required: q' but q is optional in schema.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
incident_event_filterC
incident_event · POST /incidentEvent/filter — Returns events Required: q, from, size. Allowed values: analyticsEventAction=AttributeAdded|CustomAttributeAdded|OperatingSystemFamilyAdded|OperatingSystemFamilyPathsAdded|FunctionContainerArtifactPathAdded|UserActivatedAccount|UserAdded|OrganizationInstallationsAdded|UserActivity|IncidentEvent|NotificationIncidentEvent|InsightEvent|InternalServerAttributeScan|InternalServerAttributeScanEndpoints|ApplicationConfigEntryAdded|PublisherAdded|ApplicationAdded|EndpointAdded|ArchitectureAdded|FetchApplicationConfigWithCustomizedLocationFailed|FetchApplicationConfigWithCustomizedLocationSucceed|NotificationSourceAdded|OperatingSystemAdded|ProfilePictureAdded|VulnerabilityAdded|PatchAdded|ProfilePictureFailTooLarge|ProfilePictureFailOnUpload|UpdatedDevices|FetchDevices|NotificationsSentToDevice|NotificationsTrack|FetchNotificationById|ExternalReferenceSourceAdded|ExternalReferenceAdded|ExternalReferenceDisabled|UserAddedPassword|UserChangedPassword|UserForgotPassword|OrganizationAdded|UserAuthenticatedPassword|UserResetPassword|FunctionContainerArtifactAdded|FunctionContainerAdded|CapabilityAdded|OrganizationEndpointPublisherProductProcessesAdded|OrganizationExternalReferenceSourceAdded|PublisherProductCapabilityFunctionsAdded|StatusCheckAdded|CommandAdded|OrganizationEndpointFingerprintAdded|CPEStructureAdded|CPEStructureStatusAdded|CheckAdded|LinkAdded|TagAdded|InternalTagAdded|AttackVectorAdded|CheckCommandsAdded|HashtagAdded|OrganizationHashtagAdded|InternalServerAdded|TaskAdded|TaskEndpointsEventsAdded|OrganizationConfigEntryAdded|OrganizationEndpointConfigEntryAdded|OrganizationEndpointPatchPatchPackagesEntryAdded|OrganizationEndpointAutomationsEntryAdded|OrganizationEndpointLogsAdded|LicenseAgreementAdded|ProductRawEntryAdded|PrivacyPolicyAgreementAdded|UserPrivacyPolicyAgreementAdded|OrganizationEndpointGroup|RuleAdded|PathAdded|OrganizationEndpointPublisherProductProcessInternalTags|ScriptTemplateAdded|AutomationAdded|RoleAdded|ResourceAdded|PrivilegeAdded|RoleResourcePrivilegesAdded|OrganizationTeamAdded|PatchPackageXpatch|AuditLogs|BenchmarkResult|BenchmarkCheckResult|EndpointVulnerabilityEvidence|EndpointVulnerability|CPEInfoEvent|IntegrationAction.
| Name | Required | Description | Default |
|---|---|---|---|
| q | No | query param q (str) | |
| sort | No | query param sort (str) | |
| analyticsEventAction | No | query param analyticsEventAction (str) | |
| excludeFields | No | query param excludeFields (str) | |
| includeFields | No | query param includeFields (str) | |
| includeOriginalDoc | No | query param includeOriginalDoc (bool) | |
| getLegacyData | No | query param getLegacyData (bool) | |
| from_ | No | query param from (int) | |
| size | No | query param size (int) | |
| body | No | JSON request body |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, and description lacks disclosure of behavioral traits such as side effects, authentication needs, or rate limits. It only discloses the endpoint and allowed values.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Description is a single long, run-on sentence with a very long list of allowed values, making it hard to parse. Not concise or well-structured.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given 10 parameters, no output schema, and complex allowed values, the description is incomplete. It does not explain return format, pagination, or how to use the body parameter. Also contradicts schema on required fields.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so description adds marginal value beyond schema. It does list allowed values for analyticsEventAction, which is helpful, but other parameters are not elaborated.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states it returns events via POST /incidentEvent/filter and lists allowed values for analyticsEventAction. However, it does not explicitly differentiate from sibling tools like incident_event_count.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Description mentions required parameters q, from, size and gives allowed values, but does not provide when-to-use context or alternatives among sibling tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
operating_system_family_search_by_fieldsD
operating_system_family · POST /operatingSystemFamily/searchByFields — Get object by connection. Required: from, size, q.
| Name | Required | Description | Default |
|---|---|---|---|
| from_ | No | query param from (int) | |
| size | No | query param size (int) | |
| enabled | No | query param enabled (bool) | |
| addCount | No | query param addCount (bool) | |
| q | No | query param q (str) | |
| sort | No | query param sort (str) | |
| groupBy | No | query param groupBy (str) | |
| includeFields | No | query param includeFields (Any) | |
| body | No | JSON request body |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description claims 'Required: from, size, q' but the schema shows all parameters are optional, creating a contradiction. No disclosure of search behavior, pagination, or side effects is provided.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely short, but it lacks substance and clarity. It is under-specification rather than efficient conciseness.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With 9 parameters, no output schema, and no annotations, the description fails to provide sufficient context for an agent to understand the tool's purpose, behavior, or correct usage.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Although the schema has 100% coverage, the description misinforms by labeling parameters as required when they are not, and adds no additional semantic value beyond the schema's parameter names.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description 'Get object by connection' is vague and does not clarify what an operating system family is or what 'by connection' means. It mentions the endpoint and required params, but does not distinguish it from other search tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is given on when to use this tool versus alternatives like other search_by_fields tools. The description lacks context on preferred use cases or conditions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
organization_endpoint_group_deleteC
organization_endpoint_group · DELETE /organizationEndpointGroup/delete — Disable instance of the object. Requires a JSON request body.
| Name | Required | Description | Default |
|---|---|---|---|
| body | No | JSON request body |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must fully disclose behavior. It states the tool 'disables' an instance and requires a JSON request body, but fails to explain effects (e.g., irreversible deletion, impact on related data), permissions needed, or any side effects. This is insufficient for a potentially destructive operation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is short (two sentences) but the first sentence redundantly repeats the tool name and HTTP method. 'Disable instance of the object' is concise but vague. The structure is acceptable but could be improved with front-loaded, specific information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool complexity (single parameter, no output schema, no annotations), the description lacks crucial context: the required identifier in the body, whether it's a soft or hard delete, and how it differs from related tools like organization_endpoint_group_update. An agent would struggle to invoke it correctly without external knowledge.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
There is one parameter 'body' with 100% schema description coverage (described as 'JSON request body'). The tool description repeats that it requires a JSON request body but adds no further meaning about required fields or structure. Given high schema coverage, a baseline score of 3 is appropriate, though the parameter description is minimal.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states 'Disable instance of the object' and includes the HTTP method DELETE, indicating a deletion operation. However, the use of 'Disable' rather than 'Delete' creates ambiguity about whether the action is reversible or permanent. The tool name also clearly indicates deletion, so purpose is partially clear but not precise.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives like organization_endpoint_group_update or other sibling tools. No prerequisites, scenarios, or exclusions are mentioned, leaving the agent without context for appropriate usage.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
organization_endpoint_group_insertC
organization_endpoint_group · PUT /organizationEndpointGroup/insert — insert instance of the object Requires a JSON request body.
| Name | Required | Description | Default |
|---|---|---|---|
| body | No | JSON request body |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description says 'Requires a JSON request body,' but the input schema lists body as optional (anyOf: [{}, null]), which is contradictory and misleading. No other behavioral traits (e.g., idempotency, side effects) are disclosed, and there are no annotations to help.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise at one sentence, but it includes redundant path information that is not necessary for the agent. It is front-loaded with the action, but could be streamlined.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the absence of an output schema, the description should indicate what the tool returns (e.g., created object or ID). It only states the action and requirement, leaving the agent to infer the response, which is insufficient for a creation operation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with the description 'JSON request body' already provided. The tool description adds no further meaning beyond this, so baseline score of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it inserts an instance of the object, using a specific verb and resource. However, it does not specify what fields or constraints apply, and the phrasing 'insert instance of the object' is somewhat tautological.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus siblings like organization_endpoint_group_search, delete, or update. There is no mention of prerequisites, permissions, or typical scenarios.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
organization_endpoint_group_searchC
organization_endpoint_group · POST /organizationEndpointGroup/search — Returns events Required: q, from, size.
| Name | Required | Description | Default |
|---|---|---|---|
| q | No | query param q (str) | |
| sort | No | query param sort (str) | |
| group | No | query param group (str) | |
| from_ | No | query param from (int) | |
| size | No | query param size (int) | |
| includeFields | No | query param includeFields (str) | |
| body | No | JSON request body |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, and the description only says 'Returns events' without detailing side effects, authentication needs, or rate limits. The POST method implies potential mutation but this is not clarified.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is very short, but it lacks clarity and includes incorrect information. Conciseness alone is insufficient without accuracy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema and no annotations, the description fails to explain pagination, response structure, or the distinction from many sibling search tools. The tool appears to be a search but 'events' is undefined.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema descriptions are generic (e.g., 'query param q (str)') and the description adds no meaningful context. It misstates requiredness, contradicting the schema where all parameters have default null. Baseline 3 for 100% coverage is reduced due to misleading information.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description says 'Returns events' but the tool name indicates searching for endpoint groups, creating ambiguity. It also incorrectly lists q, from, size as required when schema shows they are optional.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus sibling tools like 'organization_endpoint_group_search_by_fields' or 'endpoint_search'. The description does not specify use cases or exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
organization_endpoint_group_search_by_fieldsC
organization_endpoint_group · POST /organizationEndpointGroup/searchByFields — Get object by connection. Required: from, size, q.
| Name | Required | Description | Default |
|---|---|---|---|
| from_ | No | query param from (int) | |
| size | No | query param size (int) | |
| enabled | No | query param enabled (bool) | |
| addCount | No | query param addCount (bool) | |
| q | No | query param q (str) | |
| sort | No | query param sort (str) | |
| groupBy | No | query param groupBy (str) | |
| includeFields | No | query param includeFields (Any) | |
| body | No | JSON request body |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, so the description must disclose behavior. It incorrectly states 'Required: from, size, q' while the schema shows all parameters are optional with defaults. This contradiction could mislead the agent. The description does not mention mutation, permission requirements, or pagination behavior beyond listing params.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise, fitting in one line. However, it sacrifices clarity for brevity. It includes the HTTP method and path which is useful but not essential. Every sentence is short, but the information is incomplete.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given 9 parameters and no output schema, the description is severely incomplete. It only covers three parameters and gives no information about the return format, error handling, or typical use cases. The tool is search-related but the description does not clarify filtering, sorting, or result size.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so baseline is 3. The description only mentions three parameters (from_, size, q) without adding any semantic meaning beyond what the schema provides. The other six parameters are ignored entirely.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description says 'Get object by connection' which is vague and does not clearly indicate that this is a search-by-fields operation. It repeats the endpoint path but lacks specificity about what object type or connection means. Compared to sibling search tools, this does not differentiate its purpose.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives like organization_endpoint_group_search or endpoint_search. The description only lists the endpoint and claims some params are required, but does not explain scenarios or restrictions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
organization_endpoint_group_updateC
organization_endpoint_group · POST /organizationEndpointGroup/update — Update instance of the object Requires a JSON request body.
| Name | Required | Description | Default |
|---|---|---|---|
| body | No | JSON request body |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description must cover behavioral traits. It only states 'Update instance' and 'Requires a JSON request body', omitting idempotency, error handling, side effects, or required permissions.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is short (one sentence) but includes redundant info like the tool name and path. It could be more structured and omit the prefix.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For an update tool with no output schema and one parameter, the description lacks crucial details such as required body fields, expected object IDs, and response behavior. It is incomplete for reliable agent usage.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% for the single 'body' parameter. The description repeats 'JSON request body' from the schema, adding no additional meaning about expected fields or structure.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'Update instance of the object' with the HTTP method and path, distinguishing it from sibling tools like delete or insert. However, it lacks specifics on what fields can be updated, which slightly reduces clarity.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives (e.g., organization_endpoint_group_insert). No prerequisites, conditions, or examples are mentioned.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
organization_endpoint_patch_patch_packages_countD
organization_endpoint_patch_patch_packages · GET /organizationEndpointPatchPatchPackages/count — Count objects by stuff. Required: q, searchQuerys. Allowed values: analyticsEventAction=AttributeAdded|CustomAttributeAdded|OperatingSystemFamilyAdded|OperatingSystemFamilyPathsAdded|FunctionContainerArtifactPathAdded|UserActivatedAccount|UserAdded|OrganizationInstallationsAdded|UserActivity|IncidentEvent|NotificationIncidentEvent|InsightEvent|InternalServerAttributeScan|InternalServerAttributeScanEndpoints|ApplicationConfigEntryAdded|PublisherAdded|ApplicationAdded|EndpointAdded|ArchitectureAdded|FetchApplicationConfigWithCustomizedLocationFailed|FetchApplicationConfigWithCustomizedLocationSucceed|NotificationSourceAdded|OperatingSystemAdded|ProfilePictureAdded|VulnerabilityAdded|PatchAdded|ProfilePictureFailTooLarge|ProfilePictureFailOnUpload|UpdatedDevices|FetchDevices|NotificationsSentToDevice|NotificationsTrack|FetchNotificationById|ExternalReferenceSourceAdded|ExternalReferenceAdded|ExternalReferenceDisabled|UserAddedPassword|UserChangedPassword|UserForgotPassword|OrganizationAdded|UserAuthenticatedPassword|UserResetPassword|FunctionContainerArtifactAdded|FunctionContainerAdded|CapabilityAdded|OrganizationEndpointPublisherProductProcessesAdded|OrganizationExternalReferenceSourceAdded|PublisherProductCapabilityFunctionsAdded|StatusCheckAdded|CommandAdded|OrganizationEndpointFingerprintAdded|CPEStructureAdded|CPEStructureStatusAdded|CheckAdded|LinkAdded|TagAdded|InternalTagAdded|AttackVectorAdded|CheckCommandsAdded|HashtagAdded|OrganizationHashtagAdded|InternalServerAdded|TaskAdded|TaskEndpointsEventsAdded|OrganizationConfigEntryAdded|OrganizationEndpointConfigEntryAdded|OrganizationEndpointPatchPatchPackagesEntryAdded|OrganizationEndpointAutomationsEntryAdded|OrganizationEndpointLogsAdded|LicenseAgreementAdded|ProductRawEntryAdded|PrivacyPolicyAgreementAdded|UserPrivacyPolicyAgreementAdded|OrganizationEndpointGroup|RuleAdded|PathAdded|OrganizationEndpointPublisherProductProcessInternalTags|ScriptTemplateAdded|AutomationAdded|RoleAdded|ResourceAdded|PrivilegeAdded|RoleResourcePrivilegesAdded|OrganizationTeamAdded|PatchPackageXpatch|AuditLogs|BenchmarkResult|BenchmarkCheckResult|EndpointVulnerabilityEvidence|EndpointVulnerability|CPEInfoEvent|IntegrationAction.
| Name | Required | Description | Default |
|---|---|---|---|
| q | No | query param q (str) | |
| analyticsEventAction | No | query param analyticsEventAction (str) | |
| searchQuerys | No | query param searchQuerys (Any) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, and the description does not disclose behavioral traits such as whether the operation is read-only, any side effects, or requirements beyond listing allowed values. Simply stating 'Count objects' is insufficient.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is verbose and unstructured: it repeats the tool name and path, uses informal language ('stuff'), and includes an extremely long, unformatted list of allowed values. It fails to be concise or well-organized.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With three parameters, no output schema, and no annotations, the description should provide more context about return values, usage patterns, and param interactions. It only mentions required params and allowed values, leaving critical gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3. The description adds limited value by listing allowed values for analyticsEventAction, but it does not explain the purpose of the parameters beyond their names. The schema descriptions are minimal, but the description still adds some semantic context.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description says 'Count objects by stuff,' which is vague and does not clearly state that it counts organization endpoint patch packages. The tool name provides some clarity, but the description fails to specify the resource being counted.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives (e.g., organization_endpoint_patch_patch_packages_filter or other count tools). The description lacks context for tool selection.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
organization_endpoint_patch_patch_packages_count_1C
organization_endpoint_patch_patch_packages · POST /organizationEndpointPatchPatchPackages/count — Count objects by stuff. Required: q. Allowed values: analyticsEventAction=AttributeAdded|CustomAttributeAdded|OperatingSystemFamilyAdded|OperatingSystemFamilyPathsAdded|FunctionContainerArtifactPathAdded|UserActivatedAccount|UserAdded|OrganizationInstallationsAdded|UserActivity|IncidentEvent|NotificationIncidentEvent|InsightEvent|InternalServerAttributeScan|InternalServerAttributeScanEndpoints|ApplicationConfigEntryAdded|PublisherAdded|ApplicationAdded|EndpointAdded|ArchitectureAdded|FetchApplicationConfigWithCustomizedLocationFailed|FetchApplicationConfigWithCustomizedLocationSucceed|NotificationSourceAdded|OperatingSystemAdded|ProfilePictureAdded|VulnerabilityAdded|PatchAdded|ProfilePictureFailTooLarge|ProfilePictureFailOnUpload|UpdatedDevices|FetchDevices|NotificationsSentToDevice|NotificationsTrack|FetchNotificationById|ExternalReferenceSourceAdded|ExternalReferenceAdded|ExternalReferenceDisabled|UserAddedPassword|UserChangedPassword|UserForgotPassword|OrganizationAdded|UserAuthenticatedPassword|UserResetPassword|FunctionContainerArtifactAdded|FunctionContainerAdded|CapabilityAdded|OrganizationEndpointPublisherProductProcessesAdded|OrganizationExternalReferenceSourceAdded|PublisherProductCapabilityFunctionsAdded|StatusCheckAdded|CommandAdded|OrganizationEndpointFingerprintAdded|CPEStructureAdded|CPEStructureStatusAdded|CheckAdded|LinkAdded|TagAdded|InternalTagAdded|AttackVectorAdded|CheckCommandsAdded|HashtagAdded|OrganizationHashtagAdded|InternalServerAdded|TaskAdded|TaskEndpointsEventsAdded|OrganizationConfigEntryAdded|OrganizationEndpointConfigEntryAdded|OrganizationEndpointPatchPatchPackagesEntryAdded|OrganizationEndpointAutomationsEntryAdded|OrganizationEndpointLogsAdded|LicenseAgreementAdded|ProductRawEntryAdded|PrivacyPolicyAgreementAdded|UserPrivacyPolicyAgreementAdded|OrganizationEndpointGroup|RuleAdded|PathAdded|OrganizationEndpointPublisherProductProcessInternalTags|ScriptTemplateAdded|AutomationAdded|RoleAdded|ResourceAdded|PrivilegeAdded|RoleResourcePrivilegesAdded|OrganizationTeamAdded|PatchPackageXpatch|AuditLogs|BenchmarkResult|BenchmarkCheckResult|EndpointVulnerabilityEvidence|EndpointVulnerability|CPEInfoEvent|IntegrationAction.
| Name | Required | Description | Default |
|---|---|---|---|
| q | No | query param q (str) | |
| analyticsEventAction | No | query param analyticsEventAction (str) | |
| body | No | JSON request body |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided. The description does not disclose behavioral traits such as idempotency, side effects, or rate limits. It only states it counts, but does not describe response format or safety.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single run-on sentence with a long inline list of values, making it hard to parse. It is not front-loaded effectively and lacks structure.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Without an output schema, the description should explain what the count returns, but it does not. The input parameters are partially described, and the vague 'by stuff' does not convey the full context needed for correct invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%. The description adds a list of allowed values for analyticsEventAction beyond the schema, but contradicts itself by claiming 'Required: q' while the schema shows q as optional. It does not explain the 'body' parameter.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states it counts objects for organization endpoint patch patch packages, but is vague with 'Count objects by stuff'. It does not clearly differentiate from sibling tools like organization_endpoint_patch_patch_packages_count or filter endpoints.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives. The sibling list includes many similar tools, but no comparison or context is provided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
organization_endpoint_patch_patch_packages_filterD
organization_endpoint_patch_patch_packages · POST /organizationEndpointPatchPatchPackages/filter — Returns events Required: q, from, size. Allowed values: analyticsEventAction=AttributeAdded|CustomAttributeAdded|OperatingSystemFamilyAdded|OperatingSystemFamilyPathsAdded|FunctionContainerArtifactPathAdded|UserActivatedAccount|UserAdded|OrganizationInstallationsAdded|UserActivity|IncidentEvent|NotificationIncidentEvent|InsightEvent|InternalServerAttributeScan|InternalServerAttributeScanEndpoints|ApplicationConfigEntryAdded|PublisherAdded|ApplicationAdded|EndpointAdded|ArchitectureAdded|FetchApplicationConfigWithCustomizedLocationFailed|FetchApplicationConfigWithCustomizedLocationSucceed|NotificationSourceAdded|OperatingSystemAdded|ProfilePictureAdded|VulnerabilityAdded|PatchAdded|ProfilePictureFailTooLarge|ProfilePictureFailOnUpload|UpdatedDevices|FetchDevices|NotificationsSentToDevice|NotificationsTrack|FetchNotificationById|ExternalReferenceSourceAdded|ExternalReferenceAdded|ExternalReferenceDisabled|UserAddedPassword|UserChangedPassword|UserForgotPassword|OrganizationAdded|UserAuthenticatedPassword|UserResetPassword|FunctionContainerArtifactAdded|FunctionContainerAdded|CapabilityAdded|OrganizationEndpointPublisherProductProcessesAdded|OrganizationExternalReferenceSourceAdded|PublisherProductCapabilityFunctionsAdded|StatusCheckAdded|CommandAdded|OrganizationEndpointFingerprintAdded|CPEStructureAdded|CPEStructureStatusAdded|CheckAdded|LinkAdded|TagAdded|InternalTagAdded|AttackVectorAdded|CheckCommandsAdded|HashtagAdded|OrganizationHashtagAdded|InternalServerAdded|TaskAdded|TaskEndpointsEventsAdded|OrganizationConfigEntryAdded|OrganizationEndpointConfigEntryAdded|OrganizationEndpointPatchPatchPackagesEntryAdded|OrganizationEndpointAutomationsEntryAdded|OrganizationEndpointLogsAdded|LicenseAgreementAdded|ProductRawEntryAdded|PrivacyPolicyAgreementAdded|UserPrivacyPolicyAgreementAdded|OrganizationEndpointGroup|RuleAdded|PathAdded|OrganizationEndpointPublisherProductProcessInternalTags|ScriptTemplateAdded|AutomationAdded|RoleAdded|ResourceAdded|PrivilegeAdded|RoleResourcePrivilegesAdded|OrganizationTeamAdded|PatchPackageXpatch|AuditLogs|BenchmarkResult|BenchmarkCheckResult|EndpointVulnerabilityEvidence|EndpointVulnerability|CPEInfoEvent|IntegrationAction.
| Name | Required | Description | Default |
|---|---|---|---|
| q | No | query param q (str) | |
| sort | No | query param sort (str) | |
| analyticsEventAction | No | query param analyticsEventAction (str) | |
| excludeFields | No | query param excludeFields (str) | |
| includeFields | No | query param includeFields (str) | |
| includeOriginalDoc | No | query param includeOriginalDoc (bool) | |
| getLegacyData | No | query param getLegacyData (bool) | |
| from_ | No | query param from (int) | |
| size | No | query param size (int) | |
| body | No | JSON request body |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided. The description claims 'Required: q, from, size' but the schema marks these as optional with null defaults, causing a contradiction. No mention of other behaviors like rate limits, idempotency, or side effects.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, extremely long sentence containing a massive enumeration of values. It is not front-loaded with purpose; it starts with the endpoint path. No structure or brevity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no output schema and 10 parameters, the description fails to explain the return structure or how the filter operates. It does not differentiate from many sibling filter tools, leaving the agent to guess how to use it effectively.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema has 100% coverage with basic type descriptions. The description adds a list of allowed values for analyticsEventAction, which is helpful, but misstates that q, from, size are required (contradicting schema). This misleading information harms clarity more than helps.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states 'Returns events' but does not specify what kind of events or the tool's specific role among siblings. The name suggests filtering patch package events, but the description lists many event types without contextualizing the tool's primary function. It fails to distinguish from siblings like incident_event_filter or task_endpoints_event_filter.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives like other filter tools (e.g., incident_event_filter). No when-not-to-use scenarios or context provided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
organization_endpoint_publisher_operating_systems_searchC
organization_endpoint_publisher_operating_systems · POST /organizationEndpointPublisherOperatingSystems/search — Returns events Required: q, from, size.
| Name | Required | Description | Default |
|---|---|---|---|
| q | No | query param q (str) | |
| sort | No | query param sort (str) | |
| group | No | query param group (str) | |
| from_ | No | query param from (int) | |
| size | No | query param size (int) | |
| includeFields | No | query param includeFields (str) | |
| body | No | JSON request body |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Without annotations, the description must disclose behavior. It only mentions 'Returns events' but does not state whether the operation is read-only, any authentication needs, or pagination behavior (although from_ and size parameters are present). The claim that q, from, size are required contradicts the input schema (which lists no required parameters), further confusing the agent.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is short and front-loaded, but repetitive (includes the full tool name and endpoint). It could be more concise by removing redundancy and focusing on unique aspects.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given 7 parameters and no output schema, the description only covers three parameter names without explaining their purpose or the return format. This is insufficient for an agent to use the tool correctly, especially with similar sibling tools.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so baseline is 3. However, the description incorrectly states that q, from, size are required (schema shows they are optional with defaults null). This misleading information harms usability. No additional meaning is added for other parameters like sort, group, includeFields, or body.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states 'Returns events' and specifies the HTTP endpoint, but does not clarify what type of events or how the search works. It is clear enough for a basic search operation but lacks specificity to distinguish from similar sibling tools like organization_endpoint_publisher_product_versions_search.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives. Sibling tools such as organization_endpoint_group_search or organization_publisher_operating_systems_search are not mentioned, nor are any conditions for using this tool over others.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
organization_endpoint_publisher_product_versions_searchC
organization_endpoint_publisher_product_versions · POST /organizationEndpointPublisherProductVersions/search — Returns events Required: q, from, size.
| Name | Required | Description | Default |
|---|---|---|---|
| q | No | query param q (str) | |
| sort | No | query param sort (str) | |
| group | No | query param group (str) | |
| from_ | No | query param from (int) | |
| size | No | query param size (int) | |
| includeFields | No | query param includeFields (str) | |
| body | No | JSON request body |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations exist, and the description only says 'Returns events' without detailing behavior (e.g., authentication, rate limits, side effects). It barely adds transparency beyond the HTTP method.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is very short (one line) but lacks structure and front-loads technical details (HTTP method/path) over purpose. It is concise but not effectively organized.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With 7 parameters and no output schema, the description omits return value details and parameter format. It only mentions three parameters as required, despite schema showing optional, leaving the agent underinformed.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description claims q, from, size are required, but the schema shows all parameters are optional with null defaults. This contradiction misleads the agent. Schema coverage is 100%, but the description adds no meaningful semantics.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states it returns events via a POST search, and the name clearly indicates the resource (product versions). However, it doesn't differentiate from sibling search tools like organization_endpoint_publisher_operating_systems_search.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives. The description does not specify any context or exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
organization_endpoint_vulnerabilities_searchC
organization_endpoint_vulnerabilities · POST /organizationEndpointVulnerabilities/search — Returns events Required: q, from, size.
| Name | Required | Description | Default |
|---|---|---|---|
| q | No | query param q (str) | |
| sort | No | query param sort (str) | |
| group | No | query param group (str) | |
| from_ | No | query param from (int) | |
| size | No | query param size (int) | |
| includeFields | No | query param includeFields (str) | |
| body | No | JSON request body |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations exist, so the description carries full burden. It only says 'Returns events' without disclosing any behavioral traits (e.g., read-only, pagination, permissions, rate limits). Minimal transparency.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is very short (one sentence) but includes redundant HTTP path. It is concise but lacks structure and front-loading of key information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No output schema; description only says 'Returns events'. No details on output format, pagination, errors, or parameter dependencies. Incomplete for a 7-parameter search tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, but the description adds little: it incorrectly claims 'q, from, size' are required (schema shows they are optional with null defaults). It does not explain the meaning of parameters beyond schema definitions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states 'Returns events' and includes the HTTP method/path, indicating the tool returns search results. However, it doesn't specify what kind of events (e.g., vulnerability events) or distinguish it from sibling search tools like 'endpoint_search' or 'vulnerability_search'.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives. No prerequisities, exclusions, or context provided. The description is purely functional with no usage advice.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
organization_external_reference_source_settings_deleteC
organization_external_reference_source_settings · DELETE /organizationExternalReferenceSourceSettings/delete — Disable instance of the object. Requires a JSON request body.
| Name | Required | Description | Default |
|---|---|---|---|
| body | No | JSON request body |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description must fully convey behavioral traits. It only mentions 'Disable' and 'Requires a JSON request body', but does not disclose permanence, side effects, permissions, or reversibility. The phrase 'Disable' may conflict with the DELETE path, causing ambiguity.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence, concise and front-loaded with the resource name. However, it is under-specified and fails to earn its place by omitting critical details, making it merely adequate.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a deletion tool with one parameter and no output schema, the description should explain return values, error conditions, and confirmation requirements. It does not, leaving the agent without sufficient context for safe invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% (parameter 'body' has description 'JSON request body'), but the description adds no extra meaning beyond the schema. Moreover, it states 'Requires a JSON request body' while the schema indicates the body is optional (default null, anyOf includes null), which is misleading.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states 'Disable instance of the object' with the HTTP method and path, clearly indicating a delete/disable operation. The verb 'Disable' could be interpreted differently than 'delete' but is still specific. It distinguishes from sibling insert and update tools through the action.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives (e.g., update or insert). There is no mention of prerequisites, context, or when to avoid using the tool.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
organization_external_reference_source_settings_insertC
organization_external_reference_source_settings · PUT /organizationExternalReferenceSourceSettings/insert — insert instance of the object Requires a JSON request body.
| Name | Required | Description | Default |
|---|---|---|---|
| body | No | JSON request body |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, and the description only says 'insert instance of the object'. No disclosure of side effects, idempotency, permissions, or error conditions.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
One concise sentence including endpoint path. Could be slightly improved with line breaks for readability, but efficient overall.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No output schema, no annotations, minimal parameter description. Does not explain return values, body format, or error handling, leaving the agent under-informed.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The only parameter 'body' is described as 'JSON request body' in both schema and description, which is redundant. Schema coverage is 100% so baseline is 3, but description adds no extra meaning.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it inserts an instance of an object using PUT method, distinguishing it from sibling tools like delete and update. However, it could be more specific about which object is inserted.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives like update or delete. No context on prerequisites or typical use cases.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
organization_external_reference_source_settings_updateC
organization_external_reference_source_settings · POST /organizationExternalReferenceSourceSettings/update — Update instance of the object Requires a JSON request body.
| Name | Required | Description | Default |
|---|---|---|---|
| body | No | JSON request body |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must disclose behavior. It only states 'Requires a JSON request body' but omits side effects, authentication needs, idempotency, or error handling.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is very short and front-loaded with the tool name and HTTP path. It avoids verbosity, though the inclusion of the path could be considered redundant.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple update tool with no output schema, the description fails to explain return value, expected body structure, or success criteria, making it insufficient for an agent to invoke correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% (the only parameter 'body' has a description), so baseline is 3. The description adds no meaning beyond the schema, and the schema's description is generic, leaving the body structure unspecified.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states 'Update instance of the object' with the resource name, making the verb and resource clear. It distinguishes from sibling tools like delete/insert, but lacks specifics on what fields are updated.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives, no prerequisites, and no context about valid scenarios for updating.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
organization_publisher_operating_systems_locate_object_positionC
organization_publisher_operating_systems · GET /organizationPublisherOperatingSystems/locateObjectPosition — Returns events Required: q, positionQuery.
| Name | Required | Description | Default |
|---|---|---|---|
| q | No | query param q (str) | |
| positionQuery | No | query param positionQuery (str) | |
| sort | No | query param sort (str) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations exist and the description fails to disclose behavioral traits such as read-only nature, side effects, or authentication needs beyond the minimal 'Returns events.'
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is short but combines the name, path, and requirement in a single sentence; functional but could be better structured.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, no annotations, and 3 parameters, the description is incomplete—no details on return format, event semantics, or how to use sort.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description incorrectly claims q and positionQuery are required (contradicting schema which shows all optional) and adds no extra meaning beyond the schema's minimal descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states 'Returns events' but does not clarify what 'locate object position' means or how it differs from similar tools like organization_publisher_products_locate_object_position.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool vs alternatives; no when/not-to-use context provided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
organization_publisher_operating_systems_searchC
organization_publisher_operating_systems · POST /organizationPublisherOperatingSystems/search — Returns events Required: q, from, size.
| Name | Required | Description | Default |
|---|---|---|---|
| q | No | query param q (str) | |
| sort | No | query param sort (str) | |
| group | No | query param group (str) | |
| from_ | No | query param from (int) | |
| size | No | query param size (int) | |
| includeFields | No | query param includeFields (str) | |
| body | No | JSON request body |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Lacks annotations, so description must carry full burden. It mentions 'Returns events' but does not clarify side effects, safety, or whether it is read-only. Additionally, it claims parameters q, from, size are required, contradicting the input schema where they are optional.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence, but it redundantly includes the tool name and API path. It is concise but lacks effective structure and fails to prioritize key information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With 7 parameters, no output schema, and many sibling tools, the description is highly incomplete. It omits return format, pagination details, filtering semantics, and how it differs from similar tools.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, but descriptions are minimal (e.g., 'query param q (str)'). The tool description adds no extra meaning beyond listing required parameters (incorrectly). Baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states 'Returns events' but does not specify what kind of events or the role of operating systems. It is minimal and only slightly better than a tautology.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus siblings like organization_endpoint_publisher_operating_systems_search or other search tools. The description provides no context for selection.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
organization_publisher_products_locate_object_positionD
organization_publisher_products · GET /organizationPublisherProducts/locateObjectPosition — Returns events Required: q, positionQuery.
| Name | Required | Description | Default |
|---|---|---|---|
| q | No | query param q (str) | |
| positionQuery | No | query param positionQuery (str) | |
| sort | No | query param sort (str) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Description contradicts input schema by claiming 'q' and 'positionQuery' are required when schema lists them with default null and no required flag. No annotations provided to compensate. No disclosure of behavior like read-only or mutation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
One short sentence that is incomplete and potentially misleading. Missing critical information makes it under-specified rather than concise.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no output schema, no annotations, and a complex task (locating object position), the description fails to explain the response structure, pagination, or how to construct positionQuery. Inadequate for an agent to use correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
While schema descriptions cover all parameters, the description adds no meaning beyond the schema. It misleads by stating parameters are required, which contradicts schema. No details on format or allowed values.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states 'Returns events' and provides HTTP path, but fails to clarify what 'locate object position' means. It does not distinguish from sibling locate tools like 'organization_publisher_operating_systems_locate_object_position'.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives (e.g., search tools). The description does not mention any prerequisites or context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
organization_publisher_products_searchC
organization_publisher_products · POST /organizationPublisherProducts/search — Returns events Required: q, from, size.
| Name | Required | Description | Default |
|---|---|---|---|
| q | No | query param q (str) | |
| sort | No | query param sort (str) | |
| group | No | query param group (str) | |
| from_ | No | query param from (int) | |
| size | No | query param size (int) | |
| includeFields | No | query param includeFields (str) | |
| body | No | JSON request body |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries full burden. It claims 'Required: q, from, size' but the schema shows all parameters are optional with null defaults. It does not disclose side effects, rate limits, or whether the tool is read-only.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is very short but includes a potential contradiction about required parameters. It lacks structure and omits key information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema and 7 parameters, the description should explain return values and more context. It only says 'Returns events' but not the format or meaning.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema descriptions are minimal ('query param x (type)') and the tool description adds no additional meaning. For 7 parameters, no parameter is explained beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description says 'Returns events' but the tool name is about searching publisher products. It vaguely mentions the endpoint and required parameters but does not clearly state the tool's purpose or differentiate it from siblings like 'organization_publisher_products_locate_object_position'.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus other search tools in the sibling list. No alternatives or contextual cues provided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
organization_scan_input_insert_and_uploadC
organization_scan_input · PUT /organizationScanInput/insertAndUpload — Inserts object and stores its file Required: q.
| Name | Required | Description | Default |
|---|---|---|---|
| q | No | query param q (str) | |
| body | No | JSON request body |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries full burden. It only indicates 'inserts object and stores its file' but omits details on side effects, permissions, file handling, or error conditions.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is short but contains redundancy (tool name and endpoint path). It is not efficiently front-loaded with the core action, though it avoids unnecessary fluff.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no output schema and no annotations, the description fails to sufficiently explain the tool's behavior for a mutation operation that involves file storage. It does not clarify the role of the body parameter or the outcome of the operation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with descriptions for both parameters, so baseline is 3. However, the description adds no meaningful information beyond the schema and includes the misleading statement 'Required: q', which contradicts the schema (q is not required).
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states it inserts an object and stores its file, which is a specific verb-resource pair. However, it inaccurately claims 'Required: q' when q has no required constraints in the schema, and it does not clearly distinguish from sibling tools like organization_scan_input_upload.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives. There is no mention of prerequisites, context, or scenarios where this tool is preferred over other scan input tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
organization_scan_input_redirectC
organization_scan_input · GET /organizationScanInput/redirect — Redirect to static file by id. Required: id.
| Name | Required | Description | Default |
|---|---|---|---|
| id | No | query param id (str) | |
| preformExternalRedirect | No | query param preformExternalRedirect (bool) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries full burden for behavioral disclosure. It only mentions redirect without detailing what happens on missing id, the type of redirect, or effects of the preformExternalRedirect parameter.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is very short and gets to the point, but could be better structured to separate purpose from parameter notes. The sentence is efficient but lacks front-loading of key info.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the simplicity of the tool (2 params, no output schema, no annotations), the description is incomplete. It does not explain the redirect behavior, return type, or how the parameters affect the outcome. The contradiction about required further reduces completeness.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description adds no meaning beyond the input schema for the parameters. Worse, it contradicts the schema by stating 'Required: id' when the schema marks id as optional with a null default. The preformExternalRedirect parameter is not mentioned.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action (redirect) and resource (static file), and mentions the required parameter id. However, it could be more specific about what 'static file' refers to in the context of organization scan input, and does not differentiate from sibling redirect tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives like organization_scan_input_search or upload. The description only states that id is required but does not explain contexts or exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
organization_scan_input_searchC
organization_scan_input · POST /organizationScanInput/search — Returns events Required: q, from, size.
| Name | Required | Description | Default |
|---|---|---|---|
| q | No | query param q (str) | |
| sort | No | query param sort (str) | |
| group | No | query param group (str) | |
| from_ | No | query param from (int) | |
| size | No | query param size (int) | |
| includeFields | No | query param includeFields (str) | |
| body | No | JSON request body |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, so description should disclose behavior. It minimally says 'Returns events' but contradicts schema on required params. No mention of idempotency, authentication, or error conditions.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Very short, but the required params list is unclear due to schema contradiction. Front-loaded with action but lacks structure.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With 7 params, no output schema, and no annotations, the description fails to provide essential context like pagination, error handling, or relationship to other tools.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema descriptions are generic (e.g., 'query param q (str)') and the description adds little beyond a misleading required list. No explanation of parameter functionality or formats.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states it returns events for organization scan input search, but the claim that q, from, size are required contradicts the schema where all params are optional. This reduces clarity.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool vs. sibling search tools (e.g., automation_search, endpoint_search). Lacks when-not-to-use or alternative suggestions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
organization_scan_input_updateC
organization_scan_input · POST /organizationScanInput/update — Update instance of the object Requires a JSON request body.
| Name | Required | Description | Default |
|---|---|---|---|
| body | No | JSON request body |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description should disclose behavioral traits. It only states it requires a JSON request body, but does not mention idempotency, destructiveness, permissions, or side effects.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is very short (one sentence), but it lacks essential information. It is front-loaded with the tool name and endpoint, but conciseness here sacrifices clarity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no output schema and no annotations, the description should cover return behavior, required fields, and permissions. It does not, leaving the agent with insufficient context.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The only parameter 'body' has schema description 'JSON request body', which is trivial. The description redundantly says 'Requires a JSON request body,' adding no additional meaning about expected fields or structure.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description indicates it updates an instance but is vague: 'Update instance of the object' does not specify which object or fields. The name implies organization scan input, but the description lacks specificity. Siblings include other update tools, so differentiation is weak.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives. No prerequisites, conditions, or when-not-to-use information is provided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
organization_scan_input_uploadC
organization_scan_input · PUT /organizationScanInput/upload — Stores events Requires a JSON request body.
| Name | Required | Description | Default |
|---|---|---|---|
| body | No | JSON request body |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided. The description only says 'Stores events' with no details on side effects (overwrite/create), authentication needs, rate limits, or other behavioral traits. Very insufficient for safe usage.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is short but includes redundant endpoint path and does not add value beyond the schema. Could be more concise and informative.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Lacking annotations and output schema, the description fails to explain what 'events' are, what the response looks like, or any constraints. Incomplete for a tool with a single parameter.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so baseline 3. The description 'Requires a JSON request body' merely echoes the schema without adding meaning.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states the tool 'Stores events' and gives the endpoint, but 'events' is vague and not defined. It does not distinguish from siblings like 'organization_scan_input_insert_and_upload' or 'organization_scan_input_search'.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool vs alternatives such as 'organization_scan_input_insert_and_upload' or 'organization_scan_input_update'. The context does not help an agent decide.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
org_endpoint_external_references_searchC
organization_endpoint_external_reference_external_references · POST /organizationEndpointExternalReferenceExternalReferences/search — Returns events Required: q, from, size.
| Name | Required | Description | Default |
|---|---|---|---|
| q | No | query param q (str) | |
| sort | No | query param sort (str) | |
| group | No | query param group (str) | |
| from_ | No | query param from (int) | |
| size | No | query param size (int) | |
| includeFields | No | query param includeFields (str) | |
| body | No | JSON request body |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description must fully disclose behavioral traits. It states it returns events but does not mention read-only nature, pagination, rate limits, authentication, or response format. The required params hint at behavior but are contradicted by the schema.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is very short (one sentence) but includes redundant endpoint path. It is concise but not well-structured; it fails to front-load the most critical information about purpose and usage.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the absence of annotations and output schema, the description is severely incomplete. For a search tool with 7 parameters, it should explain return values, pagination, and how parameters affect results.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% but descriptions are minimal ('query param X (type)'). The description adds that q, from, and size are required, but the schema marks them as optional with default null, creating a contradiction. This misleads the agent about parameter necessity.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states it returns events via a search endpoint, but it does not specify what kind of events (external references) clearly. The tool name includes 'external_references_search', but the description uses 'events' without linking to the resource. It is somewhat clear but lacks specificity to distinguish it from similar sibling search tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool instead of alternatives like endpoint_search or external_reference_external_references_search_by_fields. The description does not mention any context, prerequisites, or exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
org_endpoint_publisher_os_locate_positionD
organization_endpoint_publisher_operating_systems · GET /organizationEndpointPublisherOperatingSystems/locateObjectPosition — Returns events Required: q, positionQuery.
| Name | Required | Description | Default |
|---|---|---|---|
| q | No | query param q (str) | |
| positionQuery | No | query param positionQuery (str) | |
| sort | No | query param sort (str) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries full responsibility. It claims 'Returns events' but does not disclose side effects, permissions, or idempotency. Moreover, it states that q and positionQuery are required, contradicting the schema which marks them as optional with default null. This misrepresentation undermines transparency.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is very short (one line) but includes redundant information (the endpoint path is essentially the tool name). It is not well-structured, mixing path and usage notes. While not overly verbose, it sacrifices clarity for brevity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given three parameters, no output schema, and no annotations, the description is incomplete. It fails to explain what 'locate position' returns, how the parameters affect behavior, or expected output format. An agent would lack critical context to use this tool correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema already describes all parameters (100% coverage). The description adds only the misleading claim that q and positionQuery are required, which contradicts the schema. No useful semantic context is added; instead, it introduces error.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description merely restates the endpoint path and says 'Returns events,' but it does not clearly explain what 'locate position' means or how it differs from sibling tools like 'organization_publisher_operating_systems_locate_object_position' or search tools. The purpose is vague and not differentiated.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is given on when to use this tool versus alternatives. The description mentions required parameters but does not explain scenarios for invocation. Siblings exist with similar names, but no when-to-use or when-not-to-use context is provided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
patch_management_cve_infoB
patch_management · GET /patchManagement/patch/{patchId}/cveInfo — Returns CVE info for a specific patch Required: patchId, source. Allowed values: source=XPATCH|VICARIUS.
| Name | Required | Description | Default |
|---|---|---|---|
| patchId | Yes | path param patchId | |
| source | No | query param source (str) | |
| from_ | No | query param from (int) | |
| size | No | query param size (int) | |
| showActive | No | query param showActive (bool) | |
| publisherProductHash | No | query param publisherProductHash (str) | |
| publisherOperatingSystemHash | No | query param publisherOperatingSystemHash (str) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It implies a read-only 'GET' operation but does not explicitly state side effects, authentication needs, rate limits, or other behavioral traits. The description adds minimal context beyond the endpoint and required params.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence that front-loads the endpoint and purpose. It efficiently includes required parameters and allowed values without extra fluff. Every part serves a purpose, though it could be slightly more structured.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has 7 parameters and no output schema, the description only highlights two parameters (patchId, source) and omits others like from_, size, showActive. The requiredness contradiction (source marked required in description but optional in schema) undermines completeness. Overall, it lacks sufficient detail for correct usage.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema descriptions cover 100% of parameters, but the description adds value by specifying allowed values for 'source' and stating it as required (though schema marks it optional with default null). There is a contradiction between description claiming 'source' as required and schema allowing null, which reduces clarity.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'Returns CVE info for a specific patch', specifying the verb and resource. It identifies required parameters and allowed values. However, it does not explicitly differentiate from sibling tools like patch_management_patch, which may also return patch-related info but not CVE-specific.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides guidance on required parameters and allowed values for 'source', but it lacks explicit when-to-use or when-not-to-use context compared to siblings. It does not mention alternatives or conditions for using this tool.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
patch_management_patchC
patch_management · GET /patchManagement/patch — Returns list of patches Required: searchQueries, softwareType. Allowed values: softwareType=APP|OS.
| Name | Required | Description | Default |
|---|---|---|---|
| q | No | query param q (str) | |
| searchQueries | No | query param searchQueries (Any) | |
| from_ | No | query param from (int) | |
| size | No | query param size (int) | |
| patchIds | No | query param patchIds (Any) | |
| externalPatchIds | No | query param externalPatchIds (Any) | |
| softwareType | No | query param softwareType (str) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description bears full responsibility for behavioral disclosure. It only states it returns a list of patches and lists some required parameters. No information on pagination, rate limits, error conditions, or response format is given.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise, consisting of a single sentence that efficiently conveys the tool's purpose, required parameters, and allowed values. No unnecessary information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Despite having 7 parameters and no output schema or annotations, the description is quite sparse. It does not explain the return structure, pagination behavior, or error handling, leaving the agent with insufficient context to use the tool effectively.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description adds value by noting that searchQueries and softwareType are required and that softwareType accepts only APP or OS. However, for the other five parameters (q, from, size, patchIds, externalPatchIds), no additional meaning is provided beyond the schema's minimal descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool returns a list of patches via GET. It includes the endpoint and specifies that searchQueries and softwareType are required. However, it does not differentiate from sibling tools like patch_management_patch_1 or patch_management_cve_info.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description indicates that searchQueries and softwareType are required, implying their necessity for meaningful use. However, the schema marks all parameters as optional, creating confusion. No guidance on when not to use this tool or alternative tools is provided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
patch_management_patch_1B
patch_management · POST /patchManagement/patch — Returns list of patches Required: softwareType. Allowed values: softwareType=APP|OS.
| Name | Required | Description | Default |
|---|---|---|---|
| q | No | query param q (str) | |
| from_ | No | query param from (int) | |
| size | No | query param size (int) | |
| patchIds | No | query param patchIds (Any) | |
| externalPatchIds | No | query param externalPatchIds (Any) | |
| softwareType | No | query param softwareType (str) | |
| body | No | JSON request body |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided; description only notes HTTP method POST for a read operation without explanation. Does not disclose side effects, authentication needs, or data scoping beyond softwareType.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence including tech label and usage note. Concise but omits critical context; front-loads key info but lacks structure for multi-parameter tool.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With 7 parameters, no output schema, and no annotations, description only addresses softwareType. Lacks explanation of pagination, query string, patch identifiers, and return value format, leaving significant gaps for agent use.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Adds value by specifying allowed values for softwareType (APP|OS), but incorrectly claims it's required. Other 6 parameters (q, from, size, etc.) are not elaborated beyond schema descriptions; schema coverage is 100% so baseline is 3.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clearly states it returns a list of patches, specifies required parameter and allowed values (APP|OS). Includes HTTP method and path, distinguishing it from sibling tools like patch_management_cve_info.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Claims softwareType is required, but schema lists it as optional (nullable, default null). Provides allowed values, but contradicts schema, misleading the agent.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
patch_package_links_search_by_fieldsC
patch_package_links · POST /patchPackageLinks/searchByFields — Get object by connection. Required: from, size, q.
| Name | Required | Description | Default |
|---|---|---|---|
| from_ | No | query param from (int) | |
| size | No | query param size (int) | |
| enabled | No | query param enabled (bool) | |
| addCount | No | query param addCount (bool) | |
| q | No | query param q (str) | |
| sort | No | query param sort (str) | |
| groupBy | No | query param groupBy (str) | |
| includeFields | No | query param includeFields (Any) | |
| body | No | JSON request body |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description claims 'Required: from, size, q.' but the input schema shows no required fields, contradicting the schema. No annotations exist to clarify safety or side effects. This inconsistency harms transparency.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence, but it is under-specified and includes a misleading requirement claim. It could be more concise while providing accurate, useful context.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given 9 parameters, no output schema, and no annotations, the description fails to provide sufficient context. It does not explain return values, pagination, or behavior beyond the misleading requirement statement.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with descriptions for all 9 parameters. The description adds no additional meaning beyond the schema; it incorrectly states required parameters. Baseline score of 3 is appropriate as schema already provides parameter info.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states 'Get object by connection' which identifies the general action and resource, but it's vague and does not clarify what 'patch_package_links' represents. It differentiates slightly from sibling 'patch_package_search_by_fields' by the resource name, but lacks explicit distinction.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus siblings like 'patch_package_search_by_fields' or 'endpoint_search_by_fields'. The description does not mention context, prerequisites, or alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
patch_package_search_by_fieldsC
patch_package · POST /patchPackage/searchByFields — Get object by connection. Required: from, size, q.
| Name | Required | Description | Default |
|---|---|---|---|
| from_ | No | query param from (int) | |
| size | No | query param size (int) | |
| enabled | No | query param enabled (bool) | |
| addCount | No | query param addCount (bool) | |
| q | No | query param q (str) | |
| sort | No | query param sort (str) | |
| groupBy | No | query param groupBy (str) | |
| includeFields | No | query param includeFields (Any) | |
| body | No | JSON request body |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided. The description contradicts the schema by declaring 'from', 'size', 'q' as required while the schema shows them as optional. No mention of authentication, rate limits, or return type.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Extremely brief but misleading due to the required field contradiction. The description lacks logical structure and clarity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No output schema, no explanation of return values or pagination. For a search tool, this is inadequate.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Only three parameters are mentioned, and they are mischaracterized as required. The description adds no meaningful context beyond the schema's parameter descriptions, which already exist.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states 'Get object by connection' which is vague; it likely means search by fields to retrieve objects. It also mentions 'Required: from, size, q' but these fields are optional in the schema, causing confusion.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool vs alternatives. Sibling tools include many similar search_by_fields tools, but the description does not differentiate or specify context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
publisher_product_photos_redirect_to_publisher_product_photoB
publisher_product_photos · GET /publisherProductPhotos/redirectToPublisherProductPhoto — Redirect to the best photo we have for an application. Required: productId, publisherId, photoType. Allowed values: photoType=Small|Original; httpStatus=100 CONTINUE|101 SWITCHING_PROTOCOLS|102 PROCESSING|103 EARLY_HINTS|103 CHECKPOINT|200 OK|201 CREATED|202 ACCEPTED|203 NON_AUTHORITATIVE_INFORMATION|204 NO_CONTENT|205 RESET_CONTENT|206 PARTIAL_CONTENT|207 MULTI_STATUS|208 ALREADY_REPORTED|226 IM_USED|300 MULTIPLE_CHOICES|301 MOVED_PERMANENTLY|302 FOUND|302 MOVED_TEMPORARILY|303 SEE_OTHER|304 NOT_MODIFIED|305 USE_PROXY|307 TEMPORARY_REDIRECT|308 PERMANENT_REDIRECT|400 BAD_REQUEST|401 UNAUTHORIZED|402 PAYMENT_REQUIRED|403 FORBIDDEN|404 NOT_FOUND|405 METHOD_NOT_ALLOWED|406 NOT_ACCEPTABLE|407 PROXY_AUTHENTICATION_REQUIRED|408 REQUEST_TIMEOUT|409 CONFLICT|410 GONE|411 LENGTH_REQUIRED|412 PRECONDITION_FAILED|413 PAYLOAD_TOO_LARGE|413 REQUEST_ENTITY_TOO_LARGE|414 URI_TOO_LONG|414 REQUEST_URI_TOO_LONG|415 UNSUPPORTED_MEDIA_TYPE|416 REQUESTED_RANGE_NOT_SATISFIABLE|417 EXPECTATION_FAILED|418 I_AM_A_TEAPOT|419 INSUFFICIENT_SPACE_ON_RESOURCE|420 METHOD_FAILURE|421 DESTINATION_LOCKED|422 UNPROCESSABLE_ENTITY|423 LOCKED|424 FAILED_DEPENDENCY|425 TOO_EARLY|426 UPGRADE_REQUIRED|428 PRECONDITION_REQUIRED|429 TOO_MANY_REQUESTS|431 REQUEST_HEADER_FIELDS_TOO_LARGE|451 UNAVAILABLE_FOR_LEGAL_REASONS|500 INTERNAL_SERVER_ERROR|501 NOT_IMPLEMENTED|502 BAD_GATEWAY|503 SERVICE_UNAVAILABLE|504 GATEWAY_TIMEOUT|505 HTTP_VERSION_NOT_SUPPORTED|506 VARIANT_ALSO_NEGOTIATES|507 INSUFFICIENT_STORAGE|508 LOOP_DETECTED|509 BANDWIDTH_LIMIT_EXCEEDED|510 NOT_EXTENDED|511 NETWORK_AUTHENTICATION_REQUIRED.
| Name | Required | Description | Default |
|---|---|---|---|
| productId | No | query param productId (int) | |
| publisherId | No | query param publisherId (int) | |
| photoType | No | query param photoType (str) | |
| httpStatus | No | query param httpStatus (str) | |
| preformExternalRedirect | No | query param preformExternalRedirect (bool) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description bears full responsibility. It indicates the tool performs a redirect and lists many possible HTTP status codes, but does not explain the response format, whether it modifies state, or what 'best photo' means. Partial transparency.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is cluttered with an exhaustive list of HTTP status codes, making it verbose. The structure buries the core purpose in a long string. A more concise summary of allowed values would be better.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Despite having 5 parameters and no output schema, the description fails to explain the return value (e.g., the redirect URL) or the effect of preformExternalRedirect. Lacking details for a complete understanding.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, but the description adds value by specifying which parameters are required (productId, publisherId, photoType) and the allowed values for photoType and httpStatus. This helps the agent understand constraints beyond the schema's type descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool redirects to the best photo for an application, listing required parameters and allowed values. However, it doesn't differentiate from sibling tools like organization_scan_input_redirect, and the term 'best photo' is vague.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description mentions required parameters but provides no guidance on when to use this tool versus alternatives (e.g., other redirect or photo tools). No when-not or context for selection.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
script_template_commands_search_by_fieldsC
script_template_commands · POST /scriptTemplateCommands/searchByFields — Get object by connection. Required: from, size, q.
| Name | Required | Description | Default |
|---|---|---|---|
| from_ | No | query param from (int) | |
| size | No | query param size (int) | |
| enabled | No | query param enabled (bool) | |
| addCount | No | query param addCount (bool) | |
| q | No | query param q (str) | |
| sort | No | query param sort (str) | |
| groupBy | No | query param groupBy (str) | |
| includeFields | No | query param includeFields (Any) | |
| body | No | JSON request body |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided. Description does not disclose whether the tool is read-only, destructive, or any side effects. No mention of authentication, rate limits, or pagination. The phrase 'Get object by connection' is vague.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Very short but wastes characters on the HTTP method and endpoint instead of clarifying purpose. Lacks front-loaded key information; the first part is essentially a repeat of the tool name.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no annotations, no output schema, and 9 parameters, the description is severely incomplete. It fails to explain what the tool returns, how 'connection' is used, or any usage scenario. The description is insufficient for correct tool selection and invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so description need not re-explain parameters, but it incorrectly states that three parameters are required, contradicting the schema. It adds no meaningful interpretation beyond parameter names.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description states 'Get object by connection' and lists parameters, but does not clearly explain what 'connection' refers to or what the tool does beyond a search. It fails to distinguish from sibling tools like 'script_template_search' or 'automation_search_by_fields'.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Claims 'Required: from, size, q.' but the input schema shows no required properties, creating a contradiction. No guidance on when to use this tool versus alternatives, nor any context about prerequisites or limitations.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
script_template_searchC
script_template · POST /scriptTemplate/search — Returns events Required: q, from, size.
| Name | Required | Description | Default |
|---|---|---|---|
| q | No | query param q (str) | |
| sort | No | query param sort (str) | |
| group | No | query param group (str) | |
| from_ | No | query param from (int) | |
| size | No | query param size (int) | |
| includeFields | No | query param includeFields (str) | |
| body | No | JSON request body |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden. It only says 'Returns events' but does not disclose whether the operation is read-only, idempotent, or has side effects. No mention of authentication, rate limits, or pagination behavior, though 'from' and 'size' hint at pagination.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is very short (one sentence), but it is cryptic and lacks clarity. Conciseness is achieved at the expense of comprehensibility.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given 7 parameters, no output schema, and no annotations, the description is far from complete. It fails to explain what script templates are, how the search works, or what the response contains.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema has 100% coverage, so the baseline is 3, but the description states 'Required: q, from, size' while the schema shows all parameters as optional (default null). This contradiction reduces the score. The description adds no new meaning beyond the schema's param descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states the HTTP method and endpoint (POST /scriptTemplate/search) and says 'Returns events', giving a basic sense of the tool's action. However, it does not clearly define what script templates are or what kind of events are returned, and it does not differentiate from sibling search tools like 'script_template_commands_search_by_fields'.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No usage guidance is provided. The description does not indicate when to use this tool versus other search tools among the siblings, nor does it mention prerequisites or when not to use it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
task_endpoints_event_countC
task_endpoints_event · GET /taskEndpointsEvent/count — Count objects by stuff. Required: q, searchQuerys. Allowed values: analyticsEventAction=AttributeAdded|CustomAttributeAdded|OperatingSystemFamilyAdded|OperatingSystemFamilyPathsAdded|FunctionContainerArtifactPathAdded|UserActivatedAccount|UserAdded|OrganizationInstallationsAdded|UserActivity|IncidentEvent|NotificationIncidentEvent|InsightEvent|InternalServerAttributeScan|InternalServerAttributeScanEndpoints|ApplicationConfigEntryAdded|PublisherAdded|ApplicationAdded|EndpointAdded|ArchitectureAdded|FetchApplicationConfigWithCustomizedLocationFailed|FetchApplicationConfigWithCustomizedLocationSucceed|NotificationSourceAdded|OperatingSystemAdded|ProfilePictureAdded|VulnerabilityAdded|PatchAdded|ProfilePictureFailTooLarge|ProfilePictureFailOnUpload|UpdatedDevices|FetchDevices|NotificationsSentToDevice|NotificationsTrack|FetchNotificationById|ExternalReferenceSourceAdded|ExternalReferenceAdded|ExternalReferenceDisabled|UserAddedPassword|UserChangedPassword|UserForgotPassword|OrganizationAdded|UserAuthenticatedPassword|UserResetPassword|FunctionContainerArtifactAdded|FunctionContainerAdded|CapabilityAdded|OrganizationEndpointPublisherProductProcessesAdded|OrganizationExternalReferenceSourceAdded|PublisherProductCapabilityFunctionsAdded|StatusCheckAdded|CommandAdded|OrganizationEndpointFingerprintAdded|CPEStructureAdded|CPEStructureStatusAdded|CheckAdded|LinkAdded|TagAdded|InternalTagAdded|AttackVectorAdded|CheckCommandsAdded|HashtagAdded|OrganizationHashtagAdded|InternalServerAdded|TaskAdded|TaskEndpointsEventsAdded|OrganizationConfigEntryAdded|OrganizationEndpointConfigEntryAdded|OrganizationEndpointPatchPatchPackagesEntryAdded|OrganizationEndpointAutomationsEntryAdded|OrganizationEndpointLogsAdded|LicenseAgreementAdded|ProductRawEntryAdded|PrivacyPolicyAgreementAdded|UserPrivacyPolicyAgreementAdded|OrganizationEndpointGroup|RuleAdded|PathAdded|OrganizationEndpointPublisherProductProcessInternalTags|ScriptTemplateAdded|AutomationAdded|RoleAdded|ResourceAdded|PrivilegeAdded|RoleResourcePrivilegesAdded|OrganizationTeamAdded|PatchPackageXpatch|AuditLogs|BenchmarkResult|BenchmarkCheckResult|EndpointVulnerabilityEvidence|EndpointVulnerability|CPEInfoEvent|IntegrationAction.
| Name | Required | Description | Default |
|---|---|---|---|
| q | No | query param q (str) | |
| analyticsEventAction | No | query param analyticsEventAction (str) | |
| searchQuerys | No | query param searchQuerys (Any) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided. The description does not disclose behavioral traits such as read-only nature, rate limits, or side effects. It only repeats parameter info.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single line with redundant info (repeating the name and endpoint). The allowed values list is extremely long and could be formatted better. Not concise or well-structured.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No output schema, and the description does not explain what the count returns (e.g., integer, response format). It fails to differentiate from similar sibling count tools.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% so baseline is 3. The description adds a list of allowed values for analyticsEventAction, which is not in the schema. However, it incorrectly states that q and searchQuerys are required, adding confusion.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description says 'Count objects by stuff' which is vague and unprofessional. It does not clearly state what objects are being counted (task endpoint events?). The endpoint path is mentioned but purpose is not specific.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus siblings like incident_event_count or task_event_count. No context on prerequisites or conditions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
task_endpoints_event_count_1D
task_endpoints_event · POST /taskEndpointsEvent/count — Count objects by stuff. Required: q. Allowed values: analyticsEventAction=AttributeAdded|CustomAttributeAdded|OperatingSystemFamilyAdded|OperatingSystemFamilyPathsAdded|FunctionContainerArtifactPathAdded|UserActivatedAccount|UserAdded|OrganizationInstallationsAdded|UserActivity|IncidentEvent|NotificationIncidentEvent|InsightEvent|InternalServerAttributeScan|InternalServerAttributeScanEndpoints|ApplicationConfigEntryAdded|PublisherAdded|ApplicationAdded|EndpointAdded|ArchitectureAdded|FetchApplicationConfigWithCustomizedLocationFailed|FetchApplicationConfigWithCustomizedLocationSucceed|NotificationSourceAdded|OperatingSystemAdded|ProfilePictureAdded|VulnerabilityAdded|PatchAdded|ProfilePictureFailTooLarge|ProfilePictureFailOnUpload|UpdatedDevices|FetchDevices|NotificationsSentToDevice|NotificationsTrack|FetchNotificationById|ExternalReferenceSourceAdded|ExternalReferenceAdded|ExternalReferenceDisabled|UserAddedPassword|UserChangedPassword|UserForgotPassword|OrganizationAdded|UserAuthenticatedPassword|UserResetPassword|FunctionContainerArtifactAdded|FunctionContainerAdded|CapabilityAdded|OrganizationEndpointPublisherProductProcessesAdded|OrganizationExternalReferenceSourceAdded|PublisherProductCapabilityFunctionsAdded|StatusCheckAdded|CommandAdded|OrganizationEndpointFingerprintAdded|CPEStructureAdded|CPEStructureStatusAdded|CheckAdded|LinkAdded|TagAdded|InternalTagAdded|AttackVectorAdded|CheckCommandsAdded|HashtagAdded|OrganizationHashtagAdded|InternalServerAdded|TaskAdded|TaskEndpointsEventsAdded|OrganizationConfigEntryAdded|OrganizationEndpointConfigEntryAdded|OrganizationEndpointPatchPatchPackagesEntryAdded|OrganizationEndpointAutomationsEntryAdded|OrganizationEndpointLogsAdded|LicenseAgreementAdded|ProductRawEntryAdded|PrivacyPolicyAgreementAdded|UserPrivacyPolicyAgreementAdded|OrganizationEndpointGroup|RuleAdded|PathAdded|OrganizationEndpointPublisherProductProcessInternalTags|ScriptTemplateAdded|AutomationAdded|RoleAdded|ResourceAdded|PrivilegeAdded|RoleResourcePrivilegesAdded|OrganizationTeamAdded|PatchPackageXpatch|AuditLogs|BenchmarkResult|BenchmarkCheckResult|EndpointVulnerabilityEvidence|EndpointVulnerability|CPEInfoEvent|IntegrationAction.
| Name | Required | Description | Default |
|---|---|---|---|
| q | No | query param q (str) | |
| analyticsEventAction | No | query param analyticsEventAction (str) | |
| body | No | JSON request body |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided. Description fails to disclose important behavioral traits: it does not state that it's a POST (only implied), whether it requires authentication, what the response looks like, or any rate limits. The list of allowed values is useful but not comprehensive for behavioral understanding.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Description is a single run-on sentence with a massive inline list of enum values, making it hard to parse. Not structured for quick comprehension.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no output schema and complex context (3 params, many siblings), the description is incomplete. It does not explain return values, how to count, or differentiate from similar tools.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema descriptions are minimal ('query param q (str)'). Description adds allowed values for 'analyticsEventAction' but does not explain 'q' or 'body'. The body parameter has no guidance, and it's unclear when to use it.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description states 'Count objects' but is vague; doesn't specify the resource (task endpoints events) or differentiate from sibling 'task_endpoints_event_count'. The list of allowed values for analyticsEventAction provides context but does not clarify the tool's core purpose.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool vs alternatives like 'task_endpoints_event_count' or 'task_endpoints_event_filter'. No mention of prerequisites or scenarios.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
task_endpoints_event_filterC
task_endpoints_event · POST /taskEndpointsEvent/filter — Returns events Required: q, from, size. Allowed values: analyticsEventAction=AttributeAdded|CustomAttributeAdded|OperatingSystemFamilyAdded|OperatingSystemFamilyPathsAdded|FunctionContainerArtifactPathAdded|UserActivatedAccount|UserAdded|OrganizationInstallationsAdded|UserActivity|IncidentEvent|NotificationIncidentEvent|InsightEvent|InternalServerAttributeScan|InternalServerAttributeScanEndpoints|ApplicationConfigEntryAdded|PublisherAdded|ApplicationAdded|EndpointAdded|ArchitectureAdded|FetchApplicationConfigWithCustomizedLocationFailed|FetchApplicationConfigWithCustomizedLocationSucceed|NotificationSourceAdded|OperatingSystemAdded|ProfilePictureAdded|VulnerabilityAdded|PatchAdded|ProfilePictureFailTooLarge|ProfilePictureFailOnUpload|UpdatedDevices|FetchDevices|NotificationsSentToDevice|NotificationsTrack|FetchNotificationById|ExternalReferenceSourceAdded|ExternalReferenceAdded|ExternalReferenceDisabled|UserAddedPassword|UserChangedPassword|UserForgotPassword|OrganizationAdded|UserAuthenticatedPassword|UserResetPassword|FunctionContainerArtifactAdded|FunctionContainerAdded|CapabilityAdded|OrganizationEndpointPublisherProductProcessesAdded|OrganizationExternalReferenceSourceAdded|PublisherProductCapabilityFunctionsAdded|StatusCheckAdded|CommandAdded|OrganizationEndpointFingerprintAdded|CPEStructureAdded|CPEStructureStatusAdded|CheckAdded|LinkAdded|TagAdded|InternalTagAdded|AttackVectorAdded|CheckCommandsAdded|HashtagAdded|OrganizationHashtagAdded|InternalServerAdded|TaskAdded|TaskEndpointsEventsAdded|OrganizationConfigEntryAdded|OrganizationEndpointConfigEntryAdded|OrganizationEndpointPatchPatchPackagesEntryAdded|OrganizationEndpointAutomationsEntryAdded|OrganizationEndpointLogsAdded|LicenseAgreementAdded|ProductRawEntryAdded|PrivacyPolicyAgreementAdded|UserPrivacyPolicyAgreementAdded|OrganizationEndpointGroup|RuleAdded|PathAdded|OrganizationEndpointPublisherProductProcessInternalTags|ScriptTemplateAdded|AutomationAdded|RoleAdded|ResourceAdded|PrivilegeAdded|RoleResourcePrivilegesAdded|OrganizationTeamAdded|PatchPackageXpatch|AuditLogs|BenchmarkResult|BenchmarkCheckResult|EndpointVulnerabilityEvidence|EndpointVulnerability|CPEInfoEvent|IntegrationAction.
| Name | Required | Description | Default |
|---|---|---|---|
| q | No | query param q (str) | |
| sort | No | query param sort (str) | |
| analyticsEventAction | No | query param analyticsEventAction (str) | |
| excludeFields | No | query param excludeFields (str) | |
| includeFields | No | query param includeFields (str) | |
| includeOriginalDoc | No | query param includeOriginalDoc (bool) | |
| getLegacyData | No | query param getLegacyData (bool) | |
| from_ | No | query param from (int) | |
| size | No | query param size (int) | |
| body | No | JSON request body |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, and the description only states 'Returns events' without disclosing side effects, authentication needs, rate limits, or error behavior. The long enum list is input schema information, not behavioral transparency.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is front-loaded with the endpoint and required parameters, but the long list of allowed values makes it verbose. While the enum list is informative, it could be condensed or referenced. The structure is a single block, which is acceptable but not optimally concise.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has 10 parameters and no output schema, the description is incomplete. It does not explain the return format, how to use sorting or pagination, or the purpose of the body parameter. The contradiction on required parameters further undermines completeness.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description adds value by listing allowed values for analyticsEventAction, which is not in the schema. However, it incorrectly claims q, from, size are required, while the schema shows them as optional with default null. This contradiction reduces trust and usefulness. Schema coverage is 100% with minimal descriptions, so the description should clarify but misleads.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it returns events via POST /taskEndpointsEvent/filter. It distinguishes from sibling tools like task_endpoints_event_count by indicating it returns filtered events. However, the purpose could be more specific about the event types and the filter functionality.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description mentions required parameters (q, from, size) and lists allowed values for analyticsEventAction, but it does not provide guidance on when to use this tool versus alternatives like incident_event_filter. No when-not-to-use or alternative tool recommendations are given.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
task_endpoints_event_task_typesB
task_endpoints_event · GET /taskEndpointsEvent/taskTypes — Returns a list of task types
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries full burden. It only states it returns a list, missing behavioral traits like read-only nature, authentication needs, or side effects. For a simple retrieval tool, more transparency is needed.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is one line and includes the HTTP method and endpoint, making it front-loaded and concise. However, it repeats the tool name unnecessarily. Still, it is efficient with minimal waste.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no output schema, the description should elaborate on the return value (e.g., format or types of task types). It is adequate for a simple parameterless tool but lacks detail that would help an agent understand the output. Sibling tools likely have more context.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has zero parameters, and schema description coverage is 100% (trivially). Baseline for 0 params is 4. The description does not add parameter info, but none is needed. It implicitly confirms no parameters.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it returns a list of task types via a GET endpoint. The verb 'Returns' and resource 'task types' are specific, but it does not distinguish itself from similar sibling tools like task_endpoints_event_count or task_endpoints_event_filter.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives. With many sibling tools in similar domains, explicit context or exclusion criteria would be helpful but are absent.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
task_event_countD
task_event · GET /taskEvent/count — Count objects by stuff. Required: q, searchQuerys. Allowed values: analyticsEventAction=AttributeAdded|CustomAttributeAdded|OperatingSystemFamilyAdded|OperatingSystemFamilyPathsAdded|FunctionContainerArtifactPathAdded|UserActivatedAccount|UserAdded|OrganizationInstallationsAdded|UserActivity|IncidentEvent|NotificationIncidentEvent|InsightEvent|InternalServerAttributeScan|InternalServerAttributeScanEndpoints|ApplicationConfigEntryAdded|PublisherAdded|ApplicationAdded|EndpointAdded|ArchitectureAdded|FetchApplicationConfigWithCustomizedLocationFailed|FetchApplicationConfigWithCustomizedLocationSucceed|NotificationSourceAdded|OperatingSystemAdded|ProfilePictureAdded|VulnerabilityAdded|PatchAdded|ProfilePictureFailTooLarge|ProfilePictureFailOnUpload|UpdatedDevices|FetchDevices|NotificationsSentToDevice|NotificationsTrack|FetchNotificationById|ExternalReferenceSourceAdded|ExternalReferenceAdded|ExternalReferenceDisabled|UserAddedPassword|UserChangedPassword|UserForgotPassword|OrganizationAdded|UserAuthenticatedPassword|UserResetPassword|FunctionContainerArtifactAdded|FunctionContainerAdded|CapabilityAdded|OrganizationEndpointPublisherProductProcessesAdded|OrganizationExternalReferenceSourceAdded|PublisherProductCapabilityFunctionsAdded|StatusCheckAdded|CommandAdded|OrganizationEndpointFingerprintAdded|CPEStructureAdded|CPEStructureStatusAdded|CheckAdded|LinkAdded|TagAdded|InternalTagAdded|AttackVectorAdded|CheckCommandsAdded|HashtagAdded|OrganizationHashtagAdded|InternalServerAdded|TaskAdded|TaskEndpointsEventsAdded|OrganizationConfigEntryAdded|OrganizationEndpointConfigEntryAdded|OrganizationEndpointPatchPatchPackagesEntryAdded|OrganizationEndpointAutomationsEntryAdded|OrganizationEndpointLogsAdded|LicenseAgreementAdded|ProductRawEntryAdded|PrivacyPolicyAgreementAdded|UserPrivacyPolicyAgreementAdded|OrganizationEndpointGroup|RuleAdded|PathAdded|OrganizationEndpointPublisherProductProcessInternalTags|ScriptTemplateAdded|AutomationAdded|RoleAdded|ResourceAdded|PrivilegeAdded|RoleResourcePrivilegesAdded|OrganizationTeamAdded|PatchPackageXpatch|AuditLogs|BenchmarkResult|BenchmarkCheckResult|EndpointVulnerabilityEvidence|EndpointVulnerability|CPEInfoEvent|IntegrationAction.
| Name | Required | Description | Default |
|---|---|---|---|
| q | No | query param q (str) | |
| analyticsEventAction | No | query param analyticsEventAction (str) | |
| searchQuerys | No | query param searchQuerys (Any) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided; the description claims 'Required: q, searchQuerys' but the input schema shows no required parameters, a contradiction. No disclosure of behavior like read-only, performance, or side effects.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single run-on line with no structure, mixing path, command, and a long list of allowed values. Extremely poorly organized.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool counts task events, but the description does not specify what 'task' refers to. No output schema, and no differentiation from similar count tools among siblings.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with brief descriptions. The description adds allowed values for analyticsEventAction, which adds value, but also incorrectly marks parameters as required, detracting from semantics.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description says 'Count objects by stuff', which is vague and does not clarify that this tool specifically counts task events. The name suggests it, but the description does not reinforce that.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus siblings like incident_event_count or task_endpoints_event_count. No when-to or when-not-to information.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
task_event_count_1D
task_event · POST /taskEvent/count — Count objects by stuff. Required: q. Allowed values: analyticsEventAction=AttributeAdded|CustomAttributeAdded|OperatingSystemFamilyAdded|OperatingSystemFamilyPathsAdded|FunctionContainerArtifactPathAdded|UserActivatedAccount|UserAdded|OrganizationInstallationsAdded|UserActivity|IncidentEvent|NotificationIncidentEvent|InsightEvent|InternalServerAttributeScan|InternalServerAttributeScanEndpoints|ApplicationConfigEntryAdded|PublisherAdded|ApplicationAdded|EndpointAdded|ArchitectureAdded|FetchApplicationConfigWithCustomizedLocationFailed|FetchApplicationConfigWithCustomizedLocationSucceed|NotificationSourceAdded|OperatingSystemAdded|ProfilePictureAdded|VulnerabilityAdded|PatchAdded|ProfilePictureFailTooLarge|ProfilePictureFailOnUpload|UpdatedDevices|FetchDevices|NotificationsSentToDevice|NotificationsTrack|FetchNotificationById|ExternalReferenceSourceAdded|ExternalReferenceAdded|ExternalReferenceDisabled|UserAddedPassword|UserChangedPassword|UserForgotPassword|OrganizationAdded|UserAuthenticatedPassword|UserResetPassword|FunctionContainerArtifactAdded|FunctionContainerAdded|CapabilityAdded|OrganizationEndpointPublisherProductProcessesAdded|OrganizationExternalReferenceSourceAdded|PublisherProductCapabilityFunctionsAdded|StatusCheckAdded|CommandAdded|OrganizationEndpointFingerprintAdded|CPEStructureAdded|CPEStructureStatusAdded|CheckAdded|LinkAdded|TagAdded|InternalTagAdded|AttackVectorAdded|CheckCommandsAdded|HashtagAdded|OrganizationHashtagAdded|InternalServerAdded|TaskAdded|TaskEndpointsEventsAdded|OrganizationConfigEntryAdded|OrganizationEndpointConfigEntryAdded|OrganizationEndpointPatchPatchPackagesEntryAdded|OrganizationEndpointAutomationsEntryAdded|OrganizationEndpointLogsAdded|LicenseAgreementAdded|ProductRawEntryAdded|PrivacyPolicyAgreementAdded|UserPrivacyPolicyAgreementAdded|OrganizationEndpointGroup|RuleAdded|PathAdded|OrganizationEndpointPublisherProductProcessInternalTags|ScriptTemplateAdded|AutomationAdded|RoleAdded|ResourceAdded|PrivilegeAdded|RoleResourcePrivilegesAdded|OrganizationTeamAdded|PatchPackageXpatch|AuditLogs|BenchmarkResult|BenchmarkCheckResult|EndpointVulnerabilityEvidence|EndpointVulnerability|CPEInfoEvent|IntegrationAction.
| Name | Required | Description | Default |
|---|---|---|---|
| q | No | query param q (str) | |
| analyticsEventAction | No | query param analyticsEventAction (str) | |
| body | No | JSON request body |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations exist, and the description lacks behavioral traits. It does not disclose whether the tool is read-only, requires authentication, or has side effects. The long list of allowed values for analyticsEventAction is a minor detail but insufficient.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is cluttered with a long pipe-separated list of allowed values, making it hard to parse. It is not concise and lacks structure, mixing endpoint info with parameter details in one sentence.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description fails to explain what the tool returns (count result), expected output format, or any additional context. Given the lack of output schema, the description should cover return semantics, but it does not.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema describes all three parameters with minimal descriptions (e.g., 'query param q (str)'). The description adds the list of allowed values for analyticsEventAction, which provides extra semantic info beyond the schema. However, it incorrectly states that q is required when the schema does not enforce it.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states 'Count objects by stuff' which is vague. It does not specify what 'objects' are or what 'stuff' refers to. The verb 'Count' and the resource path are mentioned but without clear context.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives. Sibling tools like task_event_count and task_endpoints_event_count_1 exist but there is no differentiation. No context about prerequisites or scenarios.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
task_event_filterC
task_event · POST /taskEvent/filter — Returns events Required: q, from, size. Allowed values: analyticsEventAction=AttributeAdded|CustomAttributeAdded|OperatingSystemFamilyAdded|OperatingSystemFamilyPathsAdded|FunctionContainerArtifactPathAdded|UserActivatedAccount|UserAdded|OrganizationInstallationsAdded|UserActivity|IncidentEvent|NotificationIncidentEvent|InsightEvent|InternalServerAttributeScan|InternalServerAttributeScanEndpoints|ApplicationConfigEntryAdded|PublisherAdded|ApplicationAdded|EndpointAdded|ArchitectureAdded|FetchApplicationConfigWithCustomizedLocationFailed|FetchApplicationConfigWithCustomizedLocationSucceed|NotificationSourceAdded|OperatingSystemAdded|ProfilePictureAdded|VulnerabilityAdded|PatchAdded|ProfilePictureFailTooLarge|ProfilePictureFailOnUpload|UpdatedDevices|FetchDevices|NotificationsSentToDevice|NotificationsTrack|FetchNotificationById|ExternalReferenceSourceAdded|ExternalReferenceAdded|ExternalReferenceDisabled|UserAddedPassword|UserChangedPassword|UserForgotPassword|OrganizationAdded|UserAuthenticatedPassword|UserResetPassword|FunctionContainerArtifactAdded|FunctionContainerAdded|CapabilityAdded|OrganizationEndpointPublisherProductProcessesAdded|OrganizationExternalReferenceSourceAdded|PublisherProductCapabilityFunctionsAdded|StatusCheckAdded|CommandAdded|OrganizationEndpointFingerprintAdded|CPEStructureAdded|CPEStructureStatusAdded|CheckAdded|LinkAdded|TagAdded|InternalTagAdded|AttackVectorAdded|CheckCommandsAdded|HashtagAdded|OrganizationHashtagAdded|InternalServerAdded|TaskAdded|TaskEndpointsEventsAdded|OrganizationConfigEntryAdded|OrganizationEndpointConfigEntryAdded|OrganizationEndpointPatchPatchPackagesEntryAdded|OrganizationEndpointAutomationsEntryAdded|OrganizationEndpointLogsAdded|LicenseAgreementAdded|ProductRawEntryAdded|PrivacyPolicyAgreementAdded|UserPrivacyPolicyAgreementAdded|OrganizationEndpointGroup|RuleAdded|PathAdded|OrganizationEndpointPublisherProductProcessInternalTags|ScriptTemplateAdded|AutomationAdded|RoleAdded|ResourceAdded|PrivilegeAdded|RoleResourcePrivilegesAdded|OrganizationTeamAdded|PatchPackageXpatch|AuditLogs|BenchmarkResult|BenchmarkCheckResult|EndpointVulnerabilityEvidence|EndpointVulnerability|CPEInfoEvent|IntegrationAction.
| Name | Required | Description | Default |
|---|---|---|---|
| q | No | query param q (str) | |
| sort | No | query param sort (str) | |
| analyticsEventAction | No | query param analyticsEventAction (str) | |
| excludeFields | No | query param excludeFields (str) | |
| includeFields | No | query param includeFields (str) | |
| includeOriginalDoc | No | query param includeOriginalDoc (bool) | |
| getLegacyData | No | query param getLegacyData (bool) | |
| from_ | No | query param from (int) | |
| size | No | query param size (int) | |
| body | No | JSON request body |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of disclosing behavior. It only says 'Returns events' and lists allowed values for one parameter. It does not mention whether the operation is read-only, destructive, or any side effects, nor does it explain pagination, sorting, or default filter behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single long sentence that mixes required parameters and allowed values without clear structure. It is not front-loaded and is harder to parse. Could be split into multiple lines or sections for clarity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given 10 parameters, no output schema, and no annotations, the description is incomplete. It does not explain return format, pagination details, default values, or how the filter works. Relying solely on the schema (which has weak descriptions) is insufficient for an agent to use this tool effectively.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema has 100% description coverage, but each description is minimal (just 'query param ...'). The description adds value by listing all allowed values for analyticsEventAction in a long string. However, it incorrectly asserts that q, from, size are required (they are not) and uses 'from_' in schema but 'from' in description. Overall, adds some meaning but with errors.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states 'Returns events' and provides the endpoint path, but does not specify what kind of events (task events) or distinguish from sibling filter tools like incident_event_filter or task_endpoints_event_filter. The purpose is somewhat clear but lacks specificity.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description claims 'Required: q, from, size' but the input schema shows these parameters are optional with defaults of null, creating confusion. There is no guidance on when to use this tool vs alternatives (e.g., other event filters), and no context on prerequisites or use cases.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
task_template_insertC
task_template · PUT /taskTemplate/insert — Insert instance of the object Requires a JSON request body.
| Name | Required | Description | Default |
|---|---|---|---|
| body | No | JSON request body |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations and a sparse description, the tool's behavioral traits are under-disclosed. The description indicates insertion but does not state whether it is idempotent, what happens on conflict, or any side effects. The agent is left to infer behavior from the word 'insert' and the HTTP method.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is short but includes extraneous text ('task_template · PUT /taskTemplate/insert') that seems to be a title or artifact. The essential information ('Insert instance of the object. Requires a JSON request body.') is present, but the structure is not optimized for quick parsing.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the lack of output schema and annotations, the description fails to fully inform the agent. It does not explain what constitutes an 'instance of the object', what fields are required in the body, or what the response will be. The tool is simple, but the description is still insufficient for reliable autonomous use.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The single parameter 'body' has a schema description of 'JSON request body', and the tool description repeats this same phrase. No additional meaning is added beyond what the schema already provides. The open-ended schema (anyOf: [{}, null]) offers no constraints or examples, making it difficult for the agent to construct valid input.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'Insert' and the resource 'task template', and the inclusion of the sibling 'task_template_insert_many' distinguishes it as a single-instance insertion tool. The specific REST endpoint (PUT /taskTemplate/insert) further clarifies the action.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus its siblings like 'automation_task_templates_insert' or 'task_template_insert_many'. The description only mentions the requirement for a JSON request body, not the context or alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
task_template_insert_manyC
task_template · PUT /taskTemplate/insertMany — Inserte instance of the object Requires a JSON request body.
| Name | Required | Description | Default |
|---|---|---|---|
| body | No | JSON request body |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, and the description only states it requires a JSON body. Missing details on idempotency, error behavior, authentication needs, or what happens on duplicate keys.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is very short, but includes a typo and redundant phrasing. It conveys basic action and requirement concisely, but could be more polished and structured.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no output schema and no annotations, the description fails to explain what a task template is, expected body format, return values, or error scenarios, making it insufficient for reliable agent use.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The only parameter 'body' is described as 'JSON request body' in both schema and description, but no indication of required structure (e.g., array of objects). The description adds no meaningful guidance beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description includes verb 'Insert' and resource 'task_template', indicating insertion of task template objects. However, 'Inserte instance' is singular and ambiguous, and the typo reduces clarity. The sibling contrast with 'task_template_insert' implies multiple, but not explicit.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives like 'task_template_insert' or update tools. Lacks context for when multiple inserts are appropriate.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
task_template_updateC
task_template · POST /taskTemplate/update — Update instance of the object Requires a JSON request body.
| Name | Required | Description | Default |
|---|---|---|---|
| body | No | JSON request body |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, so the description carries full burden. It only notes 'Requires a JSON request body' which is already in schema, but fails to disclose mutation behavior, partial vs full update, or side effects.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Description is very brief but includes a confusing prefix 'task_template ·'. While concise, it sacrifices clarity and structure.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple update tool with one parameter and no output schema, the description lacks detail about what resource is updated and any constraints, making it incomplete for effective use.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% (body parameter described). The description adds no extra meaning beyond 'JSON request body', so baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states 'Update instance of the object' which indicates update intent, but it is vague about what object (likely task_template). It distinguishes from siblings by mentioning 'update', but lacks specificity.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool vs alternatives like task_template_insert. No prerequisites or context provided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
task_updateC
task · POST /task/update — Update instance of the object Requires a JSON request body.
| Name | Required | Description | Default |
|---|---|---|---|
| body | No | JSON request body |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Description claims 'Requires a JSON request body' but schema shows body is optional (default null), creating a contradiction. No disclosure of side effects, idempotency, or error behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Description is short at one sentence, but it lacks clear structure and front-loading of key information. Could be more concise while adding clarity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity (1 optional param, no output schema), description fails to specify which task fields can be updated, how to identify the task, or return value. Lacks completeness.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% for the single parameter 'body', so baseline is 3. Description adds no extra meaning beyond what schema already provides.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states 'task · POST /task/update — Update instance of the object', which indicates it updates a task, but phrase 'instance of the object' is vague. It does not distinguish from sibling tools like task_template_update or automation_update.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives (e.g., task_template_update, task_event_count). No prerequisites or context provided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
user_invitation_deleteB
user_invitation · DELETE /userInvitation/delete — Disable instance of the object. Requires a JSON request body.
| Name | Required | Description | Default |
|---|---|---|---|
| body | No | JSON request body |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, and the description only says 'Disable instance'. It does not disclose side effects, permissions, idempotency, or error conditions for this mutation operation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise with a single sentence. It includes the tool name, HTTP method, endpoint, and purpose. However, it could be structured with clearer separation of purpose and usage.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Missing context: no output schema, no parameter details, no behavioral notes. For a delete tool, it should state what happens upon success, whether it's reversible, and required authentication.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, but the description adds no detail beyond what is in the schema ('Requires a JSON request body' is already in the schema description). Does not specify what fields the body should contain.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'Disable instance of the object' which aligns with deletion, and includes the HTTP method and endpoint. It distinguishes from siblings like user_invitation_insert, user_invitation_search, etc.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives (e.g., user_invitation_update or user_invitation_resend). The only guideline is that it requires a JSON request body, which is basic.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
user_invitation_insertC
user_invitation · PUT /userInvitation/insert — insert instance of the object Requires a JSON request body.
| Name | Required | Description | Default |
|---|---|---|---|
| body | No | JSON request body |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden but only states 'Requires a JSON request body.' It does not disclose side effects, idempotency, error behavior, or any constraints like duplicate handling. This is insufficient for safe invocation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is overly brief—a single sentence that sacrifices completeness. While concise, it omits critical behavioral and contextual information, making it insufficient for reliable tool selection.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a creation tool with no output schema and no annotations, the description should clarify what a user invitation is, required fields, and what the response signifies. It fails to provide this context, leaving the agent under-informed.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, and the description merely repeats the schema's 'JSON request body' description without adding format, structure, or example. It adds no value beyond what the schema already provides.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states 'insert instance of the object', which implies creating a user invitation, matching the tool name. However, it does not differentiate from sibling tools like user_invitation_insert_many, lacking explicit clarity on single vs. bulk operation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives such as user_invitation_insert_many or other creation tools. There is no mention of prerequisites, typical use cases, or exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
user_invitation_insert_manyC
user_invitation · PUT /userInvitation/insertMany — Insert instance of the object Requires a JSON request body.
| Name | Required | Description | Default |
|---|---|---|---|
| body | No | JSON request body |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided; description only mentions requiring a JSON request body. Does not disclose side effects, idempotency, rate limits, or what happens on validation errors.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Very concise, one sentence. Includes HTTP method and path, but no wasted words. Could be slightly more structured.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity (one parameter, no output schema), the description is too minimal. It lacks details on return value, error handling, or constraints, making it incomplete for an agent.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% (parameter 'body' with description). The description adds no extra meaning beyond 'Requires a JSON request body', which is already in the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states it inserts an instance of the object, and the tool name 'insert_many' implies multiple insertions. However, 'instance of the object' is vague and not specific to user invitations.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool vs siblings like user_invitation_insert (singular). Does not specify context such as batch insert needs.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
user_invitation_resendC
user_invitation · POST /userInvitation/resend — Resend invitation Requires a JSON request body.
| Name | Required | Description | Default |
|---|---|---|---|
| body | No | JSON request body |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, and the description only mentions 'Requires a JSON request body,' which is a parameter requirement, not a behavioral trait. It does not disclose side effects, idempotency, or required permissions for resending an invitation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is very concise (one sentence) but lacks structure; it could include separate lines for purpose and requirements. It is not wasteful but is underinformative.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no output schema and minimal description, the tool is incomplete. It fails to explain what the response indicates, what the body must contain, or how errors are handled. For a mutation action, more context is needed.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with a single 'body' parameter described as 'JSON request body.' The description adds no additional meaning beyond the schema, so baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('Resend invitation') and distinguishes itself from sibling tools like insert, delete, update, etc. However, it lacks specificity about what invitation is being resent and the expected body format.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives (e.g., user_invitation_insert for new invitations). The description does not mention prerequisites or context of use.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
user_invitation_searchC
user_invitation · POST /userInvitation/search — Returns events Required: q, from, size.
| Name | Required | Description | Default |
|---|---|---|---|
| q | No | query param q (str) | |
| sort | No | query param sort (str) | |
| group | No | query param group (str) | |
| from_ | No | query param from (int) | |
| size | No | query param size (int) | |
| includeFields | No | query param includeFields (str) | |
| body | No | JSON request body |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, and the description lacks disclosure of behavioral traits such as whether the tool is read-only, requires authentication, or has any side effects. Only basic endpoint info and required parameters are mentioned.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise (one sentence) but includes redundancy (e.g., repeats the tool name and endpoint). It is not structured with sections or bullet points, which could improve readability.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has 7 parameters and no output schema, the description is too minimal. It does not explain the nature of 'events', result format, pagination, or any other contextual details needed for effective use.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
All parameters have descriptions in the schema (100% coverage). The description only reiterates required parameters without adding semantic meaning beyond what the schema already provides. Baseline of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states the tool returns events related to user invitations via a POST endpoint, which is somewhat clear. However, 'events' is vague and does not explicitly differentiate from sibling search tools like user_invitation_search_by_fields.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives like user_invitation_search_by_fields or insertion tools. The description fails to provide context for appropriate usage.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
user_invitation_search_by_fieldsD
user_invitation · POST /userInvitation/searchByFields — Get object by connection. Required: from, size, q.
| Name | Required | Description | Default |
|---|---|---|---|
| from_ | No | query param from (int) | |
| size | No | query param size (int) | |
| enabled | No | query param enabled (bool) | |
| addCount | No | query param addCount (bool) | |
| q | No | query param q (str) | |
| sort | No | query param sort (str) | |
| groupBy | No | query param groupBy (str) | |
| includeFields | No | query param includeFields (Any) | |
| body | No | JSON request body |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries full burden. It fails to disclose behavioral traits like side effects, authentication needs, or error conditions. The misleading 'Required' statement further undermines transparency.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is short but not well-structured. It leads with HTTP method and path, which is less useful than the purpose. However, it is concise and does not contain unnecessary words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has 9 parameters and no output schema or annotations, the description is severely lacking. It does not explain the return format, how to construct queries, or what 'by connection' means. The tool cannot be used effectively with this description.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
While the input schema has 100% description coverage, the description adds confusion by incorrectly labeling some parameters as required. This makes it less helpful than the schema alone and does not add meaningful semantic context.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description says 'Get object by connection' which is vague and does not clearly specify the tool's purpose. It also incorrectly lists 'from, size, q' as required when the schema shows them as optional. No differentiation from sibling tools like user_invitation_search.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives such as user_invitation_search. The description does not provide any context about the intended use case or prerequisites.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
user_invitation_updateC
user_invitation · POST /userInvitation/update — Update instance of the object Requires a JSON request body.
| Name | Required | Description | Default |
|---|---|---|---|
| body | No | JSON request body |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided. The description only repeats the obvious requirement of a JSON request body, with no details on success/failure, permissions, or side effects.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise and includes the endpoint path, which is useful. However, it could be slightly more structured to include typical usage.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the lack of output schema, annotations, and detailed parameter info, the description is insufficient. It does not explain return values, required body structure, or behavior.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents the single parameter. The description adds no extra meaning beyond what is in the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action (Update) and the resource (instance of the object), but does not specify which fields can be updated. It distinguishes from sibling tools like insert, delete, and search.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives, no exclusions, and no prerequisites mentioned beyond requiring a JSON request body.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
user_searchD
user · POST /user/search — Returns events Required: q, from, size.
| Name | Required | Description | Default |
|---|---|---|---|
| q | No | query param q (str) | |
| sort | No | query param sort (str) | |
| group | No | query param group (str) | |
| from_ | No | query param from (int) | |
| size | No | query param size (int) | |
| includeFields | No | query param includeFields (str) | |
| body | No | JSON request body |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are present, so the description carries full burden. It only mentions the HTTP method and that it returns events, but does not disclose whether the tool is read-only, pagination behavior (though from/size params imply it), authentication requirements, or side effects. Contradictory required-field info reduces trust.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is very concise (one sentence) but front-loads contradictory information ('Required: q, from, size') and mixes endpoint details with purpose. It is not well-structured for an agent to quickly understand.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With 7 parameters, no output schema, no annotations, the description is insufficient. It does not explain the body parameter, what 'events' means, how pagination works, or the relationship to sibling user-related tools like user_invitation_search. The description leaves many gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema descriptions are minimal (just 'query param q (str)'). The description adds that q, from, size are required, but the schema marks them all optional. This contradiction harms, not helps. No further semantic info on other parameters like body, sort, group, includeFields.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description combines 'user' and 'events' ambiguously, leaving unclear whether the tool searches users or returns events. The name suggests user search, but the description says 'Returns events', creating confusion. It states the HTTP method and path, but lacks a clear statement of what the tool does.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No usage guidance is provided. The description claims 'Required: q, from, size' but the schema shows all parameters as optional with null defaults, which is a direct contradiction. No alternatives or when-to-use/not-to-use context is given.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
vrx_requestA
Issue an arbitrary request to the Vicarius vRx External Data API for endpoints without a dedicated tool. path is relative to the API base (e.g. '/endpoint/search'). Search uses RSQL in the q query param: == (equals), =in=(a,b) (in-list), =re='regex' (regex), > / < (compare). Pagination: size <= 500, from (offset) <= 10000; beyond 10000 use seek paging (sort + a q comparison on the last value). In read-only mode only GET is permitted.
| Name | Required | Description | Default |
|---|---|---|---|
| method | Yes | HTTP method, e.g. GET or POST | |
| path | Yes | Path relative to the API base, e.g. /endpoint/search | |
| query | No | Query params as an object | |
| body | No | JSON request body |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries full burden. It discloses RSQL query syntax, pagination limits (size <=500, from <=10000, seek paging beyond 10000), and read-only mode restrictions (only GET permitted). This provides comprehensive behavioral context.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single paragraph that efficiently covers purpose, usage, and behavioral details. It is front-loaded with the main purpose. Minor structure improvements (e.g., bullet points) could enhance readability, but it is concise and informative.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's generic nature (no output schema), the description adequately covers input parameters, constraints (read-only mode, pagination), and RSQL syntax. It does not describe return values, which vary by request, but the description is sufficient for a generic request tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so baseline is 3. The description adds extra meaning: it explains path is relative, specifies RSQL syntax for query parameters, and mentions pagination details. It goes beyond the schema's basic descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it issues arbitrary requests to the Vicarius vRx External Data API for endpoints without a dedicated tool. It identifies the specific resource and action, and distinguishes from sibling tools by explicitly mentioning 'for endpoints without a dedicated tool'.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description indicates when to use this tool (for endpoints without a dedicated tool) and provides context such as read-only mode restrictions. However, it does not explicitly state when not to use it or list alternative tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
vulnerability_attack_vectors_search_by_fieldsD
vulnerability_attack_vectors · POST /vulnerabilityAttackVectors/searchByFields — Get object by connection. Required: from, size, q.
| Name | Required | Description | Default |
|---|---|---|---|
| from_ | No | query param from (int) | |
| size | No | query param size (int) | |
| enabled | No | query param enabled (bool) | |
| addCount | No | query param addCount (bool) | |
| q | No | query param q (str) | |
| sort | No | query param sort (str) | |
| groupBy | No | query param groupBy (str) | |
| includeFields | No | query param includeFields (Any) | |
| body | No | JSON request body |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description contradicts the input schema by claiming 'from, size, q' are required, while the schema marks them as optional with null defaults. Additionally, no behavioral traits (e.g., side effects, authentication) are disclosed, and the term 'connection' is undefined.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence, which is concise, but it lacks structure and fails to front-load the most critical information. The required parameters claim is not accurate, wasting space.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With 9 parameters, no output schema, and no annotations, the description is severely incomplete. It does not explain the response format, pagination (though from and size are mentioned), or the nature of 'connection'. The tool is not adequately specified for an AI agent to use correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Although schema coverage is 100%, parameter descriptions are minimal and uninformative (e.g., 'query param from (int)'). The description adds only a misleading claim of required parameters. No explanation of how parameters interact or the meaning of 'q'.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description states 'Get object by connection' which is vague and does not clarify what a vulnerability attack vector is. Among many sibling search_by_fields tools, no differentiation is provided. The HTTP method and path are given but the purpose is unclear.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives. The description only lists required parameters (from, size, q) but does not explain the context or scenarios for its use.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
vulnerability_countC
vulnerability · GET /vulnerability/count — Count objects by stuff. Required: q, searchQuerys.
| Name | Required | Description | Default |
|---|---|---|---|
| q | No | query param q (str) | |
| enabled | No | query param enabled (bool) | |
| searchQuerys | No | query param searchQuerys (Any) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description must disclose behavioral traits. It briefly states the operation is a 'Count' but does not explain what the response looks like, any side effects, authentication requirements, rate limits, or error conditions. The information is insufficient for an agent to understand the tool's behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is short (one sentence) and front-loaded with the endpoint path, but it contains an incorrect requirement statement and vague phrasing. It could be concise yet accurate, but the inaccuracy reduces its effectiveness.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given 3 parameters, no output schema, and no annotations, the description should provide more context about return values, pagination, or filtering behavior. It lacks completeness and does not prepare an agent to use the tool correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Although the schema covers 100% of parameters with descriptions, the tool description incorrectly claims 'Required: q, searchQuerys' when the schema marks them as optional (anyOf with null). This misleads the agent about parameter usage. The description adds no meaningful semantics beyond the schema, and the error reduces clarity.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description says 'Count objects by stuff' which is vague and does not specify what objects are being counted (e.g., vulnerabilities). The endpoint path 'GET /vulnerability/count' hints at counting vulnerability objects, but the phrasing is unclear. It does not distinguish this tool from sibling tools like vulnerability_search or other count endpoints.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives. The description lacks information about prerequisites, when it is appropriate to call this tool, or when another tool (like vulnerability_search) would be better. The sibling list includes many related tools, but no differentiation is provided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
vulnerability_internal_tags_search_by_fieldsC
vulnerability_internal_tags · POST /vulnerabilityInternalTags/searchByFields — Get object by connection. Required: from, size, q.
| Name | Required | Description | Default |
|---|---|---|---|
| from_ | No | query param from (int) | |
| size | No | query param size (int) | |
| enabled | No | query param enabled (bool) | |
| addCount | No | query param addCount (bool) | |
| q | No | query param q (str) | |
| sort | No | query param sort (str) | |
| groupBy | No | query param groupBy (str) | |
| includeFields | No | query param includeFields (Any) | |
| body | No | JSON request body |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, so the description carries full burden. It states it is a POST request but does not disclose whether it is safe, idempotent, or what effect it has. The behavior regarding pagination, query syntax, and response format is not described, leaving the agent uninformed.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is short but includes redundant elements (tool name and path). While it is not overly verbose, it wastes characters on repetition rather than providing useful information. It could be more concise by removing the REST path and focusing on functional purpose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given 9 parameters, no output schema, and no annotations, the description is severely incomplete. It fails to explain what the tool returns, how to construct the query, the meaning of parameters like groupBy or sort, and the pagination behavior. Agent cannot use this tool effectively with the given description.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so baseline is 3. However, the description contradicts the schema by stating 'Required: from, size, q' while schema marks all as optional with default null. This misleads the agent. No additional semantics beyond schema are provided.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description says 'Get object by connection' which is vague and does not clearly state that it searches vulnerability internal tags. The tool name suggests the purpose, but the description fails to explicitly articulate it, and does not distinguish from sibling search_by_fields tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives. The description lists required parameters but provides no context about typical use cases or exclusions. With many sibling search tools, this lack of guidance is a significant gap.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
vulnerability_links_search_by_fieldsD
vulnerability_links · POST /vulnerabilityLinks/searchByFields — Get object by connection. Required: from, size, q.
| Name | Required | Description | Default |
|---|---|---|---|
| from_ | No | query param from (int) | |
| size | No | query param size (int) | |
| enabled | No | query param enabled (bool) | |
| addCount | No | query param addCount (bool) | |
| q | No | query param q (str) | |
| sort | No | query param sort (str) | |
| groupBy | No | query param groupBy (str) | |
| includeFields | No | query param includeFields (Any) | |
| body | No | JSON request body |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, and the description fails to disclose any behavioral traits such as permissions, rate limits, return value, or side effects. The description contradicts the schema by claiming required parameters.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is short, but it includes redundant information like the full endpoint path. It could be more concise by omitting the HTTP method and endpoint.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With 9 parameters and no output schema, the description is severely incomplete. It provides no information about response format, pagination, error handling, or the meaning of 'connection'. The tool's complexity demands a much richer description.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% but the descriptions are minimal (e.g., 'query param from (int)'). The description adds no additional meaning and incorrectly states that 'from, size, q' are required, contradicting the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states the HTTP endpoint and says 'Get object by connection', which gives a vague idea of searching for vulnerability links. It distinguishes from sibling tools by naming the endpoint, but the purpose is unclear due to the phrase 'by connection' without explanation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives. It incorrectly states that 'from, size, q' are required, while the schema marks them as optional, which could mislead an agent.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
vulnerability_searchA
Search vulnerabilities/CVEs. RSQL q filter, e.g. q=vulnerabilitySensitivityLevel.sensitivityLevelName=='Critical'. size<=500, from<=10000. Required: q, from, size.
| Name | Required | Description | Default |
|---|---|---|---|
| q | No | query param q (str) | |
| sort | No | query param sort (str) | |
| group | No | query param group (str) | |
| from_ | No | query param from (int) | |
| size | No | query param size (int) | |
| includeFields | No | query param includeFields (str) | |
| body | No | JSON request body |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must convey behavioral traits. It only states constraints and an example filter, but does not disclose whether the tool is read-only, what it returns, or any side effects, leaving significant gaps.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise (two sentences) and front-loads the purpose, then provides an example and constraints. It is efficient, though could be structured slightly better for readability.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Without an output schema, the description should explain return values or expected behavior after invocation. It does not mention the response format, pagination beyond size/from, or any usage notes, leaving the agent underinformed.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with descriptions, but the tool description adds value by explaining the RSQL filter format for 'q' and specifying numerical constraints on 'size' and 'from' (e.g., size<=500). This goes beyond the schema's minimal parameter descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: 'Search vulnerabilities/CVEs.' It specifies the resource and action, and provides an example filter using RSQL, which distinguishes it from other search tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives constraints on parameters (size<=500, from<=10000) and mentions required parameters (q, from, size), but does not contrast with sibling tools like vulnerability_count or other search tools, leaving usage comparisons implicit.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
TDQS
Multiple tools have nearly identical descriptions (e.g., 'Groups objects by stuff'), and many share the same actions (count, search, filter) across different entities with little distinction. The presence of GET and POST variants for count tools and numbered suffixes (e.g., _1, _2) adds confusion.
Tool names mix inconsistent patterns: long underscore-separated paths, version numbers (e.g., automations_automations_1), and generic verbs (search, count, filter) without a clear consistent structure. Some names include HTTP methods or API details, making them unwieldy.
89 tools is excessive for a single MCP server. This suggests an overly fine-grained API surface that would overwhelm agents. Many tools are redundant or too narrow, and the count far exceeds typical well-scoped servers (3-15 tools).
While many entities are covered, there are significant gaps: limited create/update/delete operations for core resources, and the inclusion of a generic 'vrx_request' tool indicates the set is incomplete. Descriptions like 'Get object by connection' are vague, and many CRUD operations are missing.
Maintenance
Resources
Unclaimed servers have limited discoverability.
Looking for Admin?
If you are the server author, to access and configure the admin panel.
Related MCP Connectors
MCP server that lets AI assistants use all OneSchema features exposed via the public API.
Unified MCP Server is a remote MCP connector for AI agents and vertical AI products that provides access to 22,000+ authorized SaaS tools across 400+ integrations and 24 categories directly inside LLMs (Claude, GPT, Gemini, Cohere). Tools operate only on explicitly authorized customer connections, enabling agents to safely read and write against live third-party systems.
An MCP server that provides an API to LLMs to manage their JumpCloud resources.
Hosted MCP server connecting AI assistants to 9,000+ apps and 40,000+ actions via Zapier.
Related MCP Servers
- FlicenseNot gradedqualityDmaintenanceA comprehensive MCP server providing over 390 tools across 66 providers, including major SaaS platforms like GitHub, Slack, and Stripe. It enables AI assistants to interact directly with a wide array of public APIs and utility services through a single interface.
- AlicenseAqualityBmaintenanceAn MCP server for vulnerability management that provides tools for automated severity and CWE classification using NLP models. It enables AI agents to query the Vulnerability Lookup API for detailed CVE information and search for security vulnerabilities across various sources.1634AGPL 3.0
- AlicenseNot gradedqualityCmaintenanceA generic MCP server that converts any OpenAPI/Swagger specification into MCP tools, enabling AI assistants to search, explore, and execute REST APIs.MIT
- FlicenseNot gradedqualityCmaintenanceA single MCP server that exposes safe, permission-checked tools for AI assistants to reach file systems, databases, APIs, Git, cloud services, and business applications.
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/Space-C0wboy/vicarius-vrx-mcp-server'
If you have feedback or need assistance with the MCP directory API, please join our Discord server