pivot_ioc

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It discloses that the tool queries multiple external services, deduplicates results, and includes a security warning about untrusted data. This adds behavioral context beyond the name, though it doesn't specify read-only or destructive nature (likely read-only).

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise: three sentences plus a bullet list and a security note. The main purpose is front-loaded, and every sentence adds value without redundancy. It's well-structured and efficient.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool has an output schema (not shown), the description doesn't need to explain return values. It covers input types, process (fanning across corpora, deduplication), and a security warning. For a pivot tool with multiple sources, it is fairly complete, though it could mention if results are limited or paginated.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% with a single 'indicator' parameter described as 'the value to pivot on.' The description adds significant meaning by listing the types of indicators accepted (host, domain, URL, hash, import hash, family), which is not in the schema's description.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's primary action: 'Pivot an indicator to related samples and families across corpora.' It specifies the types of indicators accepted (host, domain, URL, hash, import hash, family) and lists the corpora queried, effectively differentiating it from sibling tools like search_hash or enrich_ioc.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explains that the tool accepts any indicator and fans it across enabled corpora, deduplicating results. While it doesn't explicitly state when not to use it or compare to alternatives, the context implies its use for multi-source pivoting, which is adequate for an agent.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.