s1_threat_summary

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden. It discloses that the tool 'sweeps ALL matching threats server-side' (implying a potentially heavy query) and returns 'compact counts' rather than full data. It also mentions the safety cap indirectly by referencing the period filter. However, it does not explicitly note the read-only nature or any rate limits, though these are implied by the reporting context.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences, front-loaded with purpose and usage. Every clause adds value: scope, output details, when to use, and which sibling to use instead. No redundant words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Despite no output schema, the description summarizes the output structure: 'per site by incident status, analyst verdict and classification, plus estate-wide totals, the most common threat names and the machines with the most detections.' Combined with usage guidance and safety cap context, it gives a complete picture for selecting and invoking the tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the schema already documents all five parameters with meaningful descriptions. The description adds a usage hint for created_after ('pass created_after for the period') but does not introduce new parameter-level details beyond the schema. Baseline 3 applies because the schema does the heavy lifting.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

Description clearly states the tool's purpose: 'Aggregated threat counts grouped by site' with a specific verb ('sweeps' and 'returns compact counts'). It explicitly distinguishes itself from sibling tools by identifying as 'the reporting/dashboard tool' and directing users to 'Use s1_threats to drill into individual detections afterwards.'

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides explicit when-to-use guidance: 'Ideal for "threats this month across all clients" reporting' and instructs to 'pass created_after for the period.' It also names an alternative tool (s1_threats) for downstream drilling, making the decision boundary clear.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.