misp_lookup_ioc

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint, openWorldHint, idempotentHint, and destructiveHint. The description adds valuable context: redacted hits for TLP:AMBER/RED events, the structure of the summary verdict, and the caveat that 'seen_in_misp: false' does not imply safety. This exceeds what annotations alone provide.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences long. The first efficiently states the purpose. The second is lengthy but necessary to describe the output structure and key behaviors. No wasted words, though the second sentence could be slightly more concise.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's moderate complexity (IOC lookup with redacted hits and summary verdict) and the presence of an output schema, the description covers essential behavioral aspects including redaction policy and verdict interpretation. Sibling tools exist, but the description adequately distinguishes this tool's role.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Despite context signals reporting 0% schema description coverage, the provided input schema includes descriptions for both parameters ('ioc' and 'limit'). The tool description does not repeat parameter details, but the schema already provides adequate semantic meaning, so a baseline score of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool searches MISP for sightings of an indicator (IP, domain, URL, or file hash). It uses a specific verb ('Search') and resource ('MISP') and distinguishes from siblings like misp_lookup_iocs (plural) and misp_correlate_ioc.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description does not provide explicit guidance on when to use this tool versus alternatives like misp_correlate_ioc or misp_submit_ioc. It mentions that 'seen_in_misp: false' does not mean the indicator is safe, but no when-to-use or when-not-to-use criteria are given.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.