list_groups

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare read-only and non-destructive behavior, and the description does not contradict that. It adds useful behavioral context beyond the annotations: results are alphabetical, each entry includes victim counts, and the returned group value is the canonical lowercase name used across other tools. It does not mention pagination behavior, but the annotation coverage lowers that burden.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact and well structured: purpose first, then return-field details, then usage guidance. Every sentence adds information, and there is no filler or redundancy with the schema.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return-value details are covered elsewhere, and the read-only annotations handle safety. The description is complete for the core use case of resolving group names before calling sibling tools, but it leaves pagination behavior implicit, which is a minor gap for a tool whose only parameters are limit and offset.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description carries responsibility for explaining limit and offset. The description never mentions these parameters or how pagination works; the names and defaults are self-explanatory, but the agent is not told that offset pages through the alphabetical list or that the default limit truncates results.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states a specific verb ('List'), a specific resource ('all tracked ransomware groups'), and includes useful scope details (alphabetical order, victim counts). It also distinguishes this master group-list from the many sibling group-specific tools by noting that it returns the lowercase group name used by every other tool.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives explicit guidance: call this to resolve a group name before using get_group, get_group_iocs, get_yara_rules, and similar tools. This tells the agent both when this tool is appropriate and what alternatives it feeds into.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.