finding_details

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden and does so well: it discloses the 50-id cap, release-specific matching semantics, that a shared V- id returns every match labeled by benchmark, that unmatched ids land in not_found, that an all-miss call is refused with an error, and that an unbuilt knowledge base returns {"status": "not_ready"} with commands instead of erroring.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Dense but front-loaded: purpose first, then id semantics, then edge-case behavior. Every sentence carries information, though the id-format and labeling guidance makes it longer than a minimal description.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

No output schema and no annotations, so the description must cover returns and edge cases; it names the returned fields (check/fix text, benchmark, release, CCIs), the not_found list, the error-on-no-match path, and the not_ready path. Nothing an agent needs to call this correctly is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate, and it does: it defines the accepted id forms (SV-...r..._rule and V-), the 50-item limit, the matching behavior per form, and the preferred form. This adds far more meaning than the bare `ids: array of string` schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource: returns DISA's check and fix text for STIG findings, plus each finding's benchmark, release and CCIs. This is clearly separable from siblings like mitigations_for_technique and list_stigs, which serve different lookups.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explains where the ids come from (findings under a mitigations_for_technique or techniques_for_actor answer) and gives an explicit preference rule (prefer V- over rule ids, since a rule id matches only its release). It stops short of stating when to avoid this tool entirely, but the routing guidance is clear.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.