analyze_handshake_failures

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description must carry the behavioral disclosure burden. It explains the high-level classification behavior but never says whether the tool reads a capture file, how it detects 'silent timeouts', whether it is read-only, or what the analysis consumes/produces beyond the output schema.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, front-loaded sentence that communicates the core distinction with no filler. Every word adds meaning, making it an efficient opener for the tool.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The output schema may cover return structure, but the tool is missing critical input semantics and behavioral context. The path parameter is unexplained, there are no annotations, and the description does not state what kind of input is expected, leaving an agent uncertain before calling the tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The only parameter, 'path', has no schema description and the tool description does not mention it at all. At 0% schema coverage, an agent has no way to know whether path refers to a pcap file, a directory, a remote endpoint, or something else.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific analytical action—separating reset/refused TCP connections from silent timeouts—and names the exact resource (handshake failures) plus the context (service unreachable). This clearly distinguishes the tool from siblings like find_tcp_anomalies or measure_rtt.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The phrase 'when a service is unreachable' gives a clear invocation context and the intended diagnostic distinction. It does not explicitly name alternatives or when-not-to-use cases, but the condition is concrete enough to guide selection.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.