abnormal_cases_list

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden for behavioral transparency. It communicates that only 'active' cases are returned, which is a meaningful behavioral trait, and that cases group related threats—useful context for what the returned data represents. However, it does not disclose pagination behavior beyond what the schema already shows, nor does it mention authentication requirements, rate limits, or the absence of certain fields. Given the simple read/list nature, the disclosure is adequate but not rich.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single focused sentence that front-loads the main action and resource, and adds one clarifying clause about cases grouping threats. It is appropriately sized with no filler. It could arguably use one more sentence for usage guidance, but as written it is concise and well-structured.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple list tool with zero required parameters, full schema coverage, and no output schema, the description is mostly sufficient: it names the resource, the active-case scope, and the grouping concept. Gaps include not mentioning the default page size, not explaining what fields will be returned (though no output schema exists), and not differentiating from the sibling get tool. These are moderate gaps rather than fatal ones.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the baseline is 3. The description adds minimal parameter-level meaning: it does not explain the OData filter syntax, page size limits, or page numbering beyond what the schema already states. No extra semantics are needed for an agent to call it, but it also does not add value like examples of valid filter expressions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb ('List') and resource ('active security investigation cases in Abnormal Security'), and clarifies that cases group related threats for analyst review and workflow management. However, it does not explicitly differentiate itself from its sibling abnormal_cases_get, which is a close cousin that retrieves case details—though the 'List' verb plus the pagination parameters make the list intent clear enough.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no explicit when-to-use or alternative guidance. The phrase 'active security investigation cases' implies a read-only listing use case, and the pagination parameters imply enumeration, but it does not name sibling tools like abnormal_cases_get or abnormal_threats_list as alternatives for getting details or related threats. The context is clear enough for a simple list call but leaves selection reasoning to the agent.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.