watch_brief

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden and does disclose real behavior: the exact priority ordering of the three finding classes and the fallback path when only one snapshot exists. It does not state that the operation is side-effect free, nor anything about cost/performance, but the substantive behavioral traits an agent needs are present.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with the purpose, then the ranking logic, then the edge case, then the Args block. Every sentence contributes; the only minor waste is restating the 0.10 default that the schema already carries.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return values need not be explained, and the ranking/fallback behavior is covered. The remaining hole is ctx: with 0% schema coverage and no mention in prose, an agent cannot know whether it is required, what form it takes, or when to omit it.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%, so the description must compensate. It does well for epss_threshold, giving the units, the 0.0-1.0 range and the meaning of a 'spike' plus its default. But the ctx parameter is never mentioned in either schema or description, leaving half the surface undocumented.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific deliverable: a prioritized patch brief built from the estate's latest snapshots, and names the ranking criteria (KEV, EPSS spikes, new exposure). It is distinguishable from siblings like check_kev or get_epss_score because it is clearly a synthesis over the estate, though it never names watch_diff or generate_vuln_report as the adjacent alternatives.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is implied through the audience framing ('the patch order a SOC/GRC review actually works in') and one degenerate case is handled ('with only one snapshot on record, returns a current-state brief instead'). However there is no explicit when-not-to-use and no named alternative for related tasks such as diffing snapshots or generating a full report.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.