DLP perimeter false positives report

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare the operation as read-only and non-destructive. The description adds that the result is an aggregation (counts per boundary value) rather than raw events, and that it supports pagination and boundary-type filtering, providing context beyond simple read-only status.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences convey the tool's purpose, output structure, and capabilities. The first sentence front-loads the verb and resource; the second succinctly notes filtering and pagination. No filler or repetition.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

There is no output schema, so the description carries the burden of explaining return values; it does so by stating each row is a boundary value with the number of endpoints reporting false positives. Combined with annotations for safety and schema-covered parameters, the tool is fully specified for an agent to invoke correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

All parameters are fully described in the input schema (100% coverage), so the description's mention of 'filtering by boundary type' adds no new detail beyond schema's enum explanations. It does not elaborate on pagination parameters, but schema already covers page/pageLimit defaults and caps.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with the verb 'Retrieves' and specifies the exact resource: false positives reported by endpoints in the enterprise perimeter (containment boundaries). It clarifies the output structure (boundary value with endpoint count), which distinguishes it from sibling DLP reports that focus on specific boundary types or confirmed events.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description establishes when to use the tool: to get an aggregate view of false positives by boundary value across the enterprise perimeter. It notes filtering and pagination, but does not explicitly compare against sibling tools like dlp_network_dcfp_report or the per-type reports, so alternatives are not ruled out.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.