get_group_iocs

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and destructiveHint=false, so the safety profile is covered. The description adds useful response-shaping behavior (grouping by type, optional filtering to keep responses small), but does not disclose any other side effects or runtime behavior. With annotations present, this is adequate but not exceptional.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The main action is front-loaded in one clear sentence, followed by a compact Args block. There is no filler or repetition of schema information; every line adds value.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With an output schema present, annotations covering safety, and both parameters semantically explained, the tool is largely complete for a simple read operation. It would be slightly improved by pointing to list_ioc_groups for discovering valid group names, but this is a minor gap.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% and neither parameter has enums, so the description carries the full burden for parameter meaning. It explains 'group' with a concrete example ('lockbit3') and fully documents 'ioc_type' by listing all accepted values and its purpose of keeping the response small.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('Get') with a precise resource ('indicators of compromise for one ransomware group') and adds 'grouped by type', clearly communicating what the tool returns. It is distinguishable from siblings like list_ioc_groups or get_yara_rules by naming a single group and IOC types.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies the tool is for fetching IOCs for a specific named group and explains how to narrow results with ioc_type, but it never states when to prefer this over related tools such as list_ioc_groups or how to discover valid group names. Usage context is inferred rather than explicit.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.