top_risky_flows

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the behavior burden and does well: it discloses the look-back scoping, enumerates exactly which ports are considered high-risk, and describes the aggregation result (ports with the most observed flows). It does not state permissions or rate limits, but the read-only analytical nature is clear from 'Rank'/'Scans'.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with the purpose sentence, then a scannable Args block. Slight overlap between the opening line and the second paragraph, but every sentence adds usable context with no padding.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return values need not be spelled out, and the description supplies the scan scope, port set, and parameter meaning. It stops short of noting whether the result is ranked or limited in size, but nothing critical is missing for correct invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate, and it does: both parameters are explained with semantics (look-back window in hours; max flow samples inspected per port), valid ranges (1–720, 1–1000), and a default for hours. This fully covers the two-parameter gap.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (rank) and resource (risky-service exposure by counting flows to sensitive ports), and immediately names the domain (management/data ports) so an agent can distinguish it from siblings like search_flows or top_vulnerable_hosts. The port list makes the scope unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives a use case ('A fast way to spot lateral-movement surface') but never states when to prefer this over alternatives such as search_flows or get_conversations, nor any prerequisites. Usage is implied rather than directed.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.