find-unknown-endpoints

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden and does: it declares 'Read-only', discloses the three underlying data pulls, enumerates the per-endpoint payload blocks, and explains derived classifications (profile shapes with the numbers each test used). It also discloses non-obvious behaviors: noise classes are counted but suppressed from output, and the timeline bucket size changes with range under a shared spike rule.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with the operative question and then the disambiguation, so the agent gets the decision-relevant content first. The middle is dense and run-on (a long comma-chained list of endpoint fields), but each clause carries real information rather than filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 13-parameter tool with no output schema, the description supplies the return shape in detail (per-direction blocks, peers, ports, policy mix, timestamps) plus truncation/ranking semantics that live only in the schema. Nothing needed to call it correctly or interpret the result is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 92%, so the schema already documents nearly every parameter. The description reinforces the `ip` mode and the include_noise gating, but largely restates what the schema says rather than adding new semantics; the field-level detail it provides (neighbourhood, admin flag) describes return values, not inputs.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

Opens with the exact question the tool answers ('Which IP addresses show up in traffic that the PCE does not know as a workload at all') and then formalizes the definition of 'unknown' precisely (no workload attached to that side AND not an interface address of any inventoried workload). It explicitly names and rules out the nearest sibling, find-unmanaged-traffic, so an agent can route without opening either schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives a clear discriminator against find-unmanaged-traffic ('no app label' vs. no workload plus no interface match) and states the two operating modes (list vs. profile-a-single-address with `ip`). It also states when noise endpoints appear (only with include_noise). Missing a short 'reach for this when…' framing for the broader tool family (get-traffic-flows, discover-process-egress), but the alternatives are largely addressed.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.