analyze-memory-dump

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Even though annotations already declare readOnlyHint=true and destructiveHint=false, the description adds substantial behavioral context: plugins run sequentially, each independently reports success/failure/unavailability, a single failure does not fail the overall analysis, malfind output requires analyst review, and no results are fabricated. These details go far beyond the annotations and help the agent set expectations correctly.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact and front-loaded, starting with a precise purpose statement, then listing the plugins and behavioral caveats. Each sentence contributes essential information without redundancy, making it efficient and well-structured for an agent to scan.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with one parameter, no output schema, and moderate complexity, the description is thorough: it covers input type, plugin sequence, failure handling, output interpretation, and domain restriction. The lack of a return structure is mitigated by the detailed explanation of what each plugin reports, making the description sufficient for invocation and result understanding.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema covers the only parameter, filePath, with a clear description and example (i.e., /evidence/winmem.raw). The tool description adds no additional parameter-specific meaning, only reference to 'Windows memory dump' in general; given the 100% schema coverage, a baseline of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'Analyze a Windows memory dump' and enumerates four distinct Volatility plugins, making its function unmistakable. It clearly distinguishes itself from sibling extraction tools (extract-metadata, extract-strings) by focusing on deep forensic analysis rather than simple extraction.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description states it is 'designed for Windows memory dumps' and notes the plugins are Windows-specific, providing a clear exclusions for non-Windows files. However, it does not explicitly compare with the sibling tools or state when to choose them instead, leaving the alternative guidance implicit.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.