wireshark_cli

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Without annotations, the description must fully disclose behavior. It mentions 'allowlisted binaries only,' implying a security constraint, but does not describe side effects, required permissions, or typical outputs. The tool's actual behavior (running a CLI command) is left implicit.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is extremely short but not effectively concise; it sacrifices clarity for brevity. It could be replaced by a tautology of the name. Each word should add value, but 'expert escape hatch' is uninformative.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given three parameters, no annotations, and an output schema presumably present, the description is insufficient. It does not explain return values, usage context, or how to correctly invoke the tool. An AI agent would lack critical information to use it safely.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has three parameters (tool, args, timeout) with 0% description coverage. The description adds no meaning beyond the schema, failing to explain the role of each parameter (e.g., what 'tool' refers to, format of 'args').

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description 'Expert escape hatch for allowlisted Wireshark binaries only' is vague. It hints at an advanced bypass mechanism but does not specify what the tool actually does (e.g., execute a Wireshark CLI command). It fails to distinguish from sibling tools like capture_start or sharkd_open.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this tool versus alternatives. The phrase 'expert escape hatch' suggests it is for advanced users bypassing normal flows, but there are no explicit when-to-use or when-not-to-use instructions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.