Threat Report

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, etc. The description adds significant behavioral context beyond annotations: rate limits (30/hr Free, 500/hr Pro), breaking change in enrichment.vulns (list of strings pre-1.16 vs list of VulnInfo objects), and the return shape. No contradiction with annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise and well-structured: first sentence states purpose and scope, following sentences add usage guidance, limitations, breaking changes, and rate limits. Every sentence adds value, and the information is front-loaded. No wasted words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Despite having an output schema (not shown but mentioned), the description still outlines the return shape ('Returns {ip, enrichment, abuseipdb, shodan, asn, threat_level}'). It covers all important aspects: what it does, when to use it, behavioral details, limitations, and rate limits. For a one-parameter tool with high schema coverage and annotations, this is complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% and the schema already explains the ip parameter adequately (must be public IPv4/IPv6, private/reserved rejected). The tool description adds minimal extra meaning ('Use for IP investigation'), but does not provide new syntax or format details beyond what the schema already states. Baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it queries a comprehensive threat profile for an IP, listing specific data sources (Shodan, AbuseIPDB, ASN/geolocation, open ports). It also explicitly distinguishes from the sibling 'domain_report' by saying 'for domain data use domain_report'. This provides specific verb+resource and differentiates among siblings.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives explicit usage context: 'Use for IP investigation and SOC alert triage' and directs to a sibling tool for domain data. It also notes limitations (ASN prefixes at most 50, breaking change in vulns format) and rate limits, helping the agent decide when to use this tool versus alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.