aggregate_alerts

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and openWorldHint=false, so the safety profile is covered. The description adds real semantics beyond that: the operation is a terms aggregation and sub_field produces a second split, which tells the agent this is a bucketing operation. It does not disclose ordering, top-N limits, whether counts are exact, or how filters combine, and with no output schema the result shape stays opaque.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The purpose is front-loaded in the first clause, followed by the high-value field enumeration. The long comma list is dense but each entry is actionable. The unannounced '...' is the one structural wart, since it leaves the agent unsure whether other fields are accepted.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 10-parameter aggregation tool with no output schema, the definition covers the most consequential gap (valid field values) but leaves the response shape, bucket ordering, and the size parameter unexplained. An agent can form a correct call but cannot predict whether it will get all buckets or only a truncated set. Adequate rather than complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema leaves the required 'field' parameter completely undescribed, and the description compensates by enumerating concrete valid values (rule.id, agent.name, data.srcip, data.id, rule.groups, etc.) and by explaining sub_field as a second split. It adds little for the filter parameters because the schema already documents query, from/to, agent, rule_ids, and min_level. 'size' remains undocumented in both places, and the trailing ellipsis is ambiguous as to whether the field list is exhaustive.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The opening sentence gives a specific verb, resource, and mechanism: count alerts, aggregated by a terms field. It implicitly separates itself from retrieval tools like search_alerts by making the output a count rather than documents. It stops short of naming any sibling explicitly, so an agent must infer the boundary.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no when-to-use / when-not-to-use guidance and no mention of search_alerts as the alternative for retrieving alert records. The usage is only implied by the verb 'Count' and by the optional sub_field split. An agent gets no stated conditions, prerequisites, or exclusions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.