Restore previously quarantined emails associated with one or more security events. Submit event IDs to initiate recovery and receive task IDs for tracking.
Restore previously quarantined emails behind one or more security events. Returns task IDs.
| Name | Required | Description | Default |
|---|---|---|---|
| scope | No | MSP keys only: the farm:tenant scope the IDs belong to. | |
| eventIds | Yes | Event IDs. |
Changes observed during successful MCP inspections.
v2.3.0Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full behavioral burden. It discloses that the operation mutates quarantined emails and returns task IDs, which hints at asynchrony, but it doesn't connect this to avanan_get_task_status, nor mention permissions, reversibility, or side effects. This is a meaningful but incomplete behavioral disclosure.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences with no filler; the core action and return value are front-loaded. The phrase 'previously quarantined' is necessary context rather than redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a two-parameter tool with a complete schema, the description is close to adequate, but it omits the follow-up contract: the return of task IDs implies a task lifecycle, and an agent isn't told to monitor via avanan_get_task_status. It also doesn't distinguish from the closely related avanan_restore_emails, leaving selection ambiguity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema covers 100% of parameters, so the schema already documents eventIds and scope. The description adds that eventIds refer to security events, but doesn't clarify how scope is used or how multiple event IDs combine.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Restore') and identifies the resource ('previously quarantined emails behind one or more security events'), making the tool's purpose unambiguous. It stops short of explicitly differentiating from avanan_restore_emails or avanan_quarantine_events, so it doesn't earn the top score.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No when-to-use or exclusion guidance is given; there is no mention of when to prefer this over avanan_restore_emails or how it relates to avanan_quarantine_events. An agent must infer the use case from the tool name and the single line.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.