Execute Saved Search

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It discloses that results are capped by max_results, that mode and timing are output, and that execution is constrained by user permissions. However, it does not detail what happens with time overrides, how errors are handled, or whether the tool is read-only or mutating (though executing a search is generally read-only). The description adds some behavioral context but lacks depth.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise and front-loaded with the core purpose. It uses two short paragraphs: one for usage and mode selection, another for outputs and security. Every sentence adds value, though the security note could be considered redundant with typical expectations.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool has 7 parameters, no output schema, and no annotations, the description is moderately complete. It covers the main purpose, mode selection, outputs, and security, but lacks details on parameter semantics for several fields and does not explain the behavior of time overrides or how the 'job' mode differs in terms of polling or retrieval. It is adequate but not comprehensive.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate. It explains the 'mode' parameter (oneshot vs job) and mentions 'max_results' caps the results list, but it does not explain 'app', 'owner', 'earliest_time', 'latest_time', or 'name' beyond what the schema shows. The description adds meaning for two of seven parameters, which is partial compensation.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool runs a saved search by name with optional time overrides and mode selection. It distinguishes itself from siblings like run_splunk_search and run_oneshot_search by focusing on executing existing saved searches, and mentions outputs and security constraints.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides clear context on when to use this tool: to execute existing reports/automations quickly. It explains the two modes ('oneshot' for immediate results, 'job' for progress tracking and large result sets), which helps the agent choose appropriately. However, it does not explicitly mention when not to use it or name alternative tools for different scenarios.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.