host_connections

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden. 'Watch traffic' implies a passive read-only observation and it discloses the output shape (total plus per-address-family), but it says nothing about permissions, whether it queries remote hosts, sampling windows, or rate limits.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

A single front-loaded sentence that leads with the metric and scope before the use cases. Dense but each clause contributes; slightly long but no filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a two-parameter, zero-required read tool with no output schema and no annotations, the description supplies the missing return-value context (total and by remote address family) and the operational intent. Only target-selector behavior and access requirements remain unexplained.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 50%: the 'target' parameter is fully documented in the schema, while 'port' has only constraints. The description merely restates the 443 default and adds no meaning beyond it, and does not clarify the target selector syntax or what 'all' resolves to.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific resource and scope: established TCP connections per host on a local port, broken down by total and remote address family. It is clearly distinguishable from a generic port listing, though it never names or contrasts with the sibling host_ports, which an agent could easily confuse it with.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives concrete operational scenarios for use — watching traffic migrate from an old ingress to a new one, or draining before node removal — which tells the agent when this tool is the right call. It stops short of explicit exclusions or naming an alternative tool.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.