FEA

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full behavioral burden. It doesn't state that this is a non-mutating lookup, what the return value looks like (a block number? an address?), or any constraints. For a zero-annotation tool this is a significant gap.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

A single, front-loaded sentence with no filler; the core mapping is stated immediately. It is efficient, though its brevity is part of why the transparency and parameter gaps remain.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema and no annotations, the description should explain the return value and the meaning of image/part. It omits all of this, so an agent cannot fully predict what calling it produces or how to select a partition.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate for all three params. It only implicitly clarifies blkls_offset; 'image' and 'part' (partition selection) are entirely unexplained in both schema and description, leaving half the interface undocumented.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb ('Map') and resource ('blkls stream byte offset ... to the real file-system block'), which is far more precise than the bare name 'blkcalc'. It also anchors itself by naming the sibling grep_unallocated as the offset source, helping distinguish it. The remaining gap is that jargon like 'blkls' and 'real file-system block' is not unpacked.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Implies when to use it by specifying the offset comes 'from a sleuthkit-mode grep_unallocated hit', which is useful context. However, it never states exclusions or names alternatives (e.g., block_read) for directly reading a block, so the agent must infer the boundary.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are supplied, so the description carries the full burden of behavioral disclosure. 'Read' implies a non-mutating operation, but nothing is said about output format (raw bytes vs. text), error behavior for invalid block numbers, or how part/count interact. For an unannotated tool this is a substantial gap.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

A single front-loaded sentence with no filler; the primary action and the workflow cue come first. It is efficient, though the terseness is part of what leaves the behavioral gaps unfilled.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Five parameters at 0% schema coverage, no annotations, and no output schema, yet the description is one short sentence. It does not supply enough for an agent to call the tool correctly on ambiguous inputs such as count or as_text.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% across five parameters, so the description must compensate and largely does not. 'By number' weakly clarifies that block is a block index, but image, part, count, and especially as_text (which changes the output representation) are left entirely unexplained.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Read file-system blocks by number'), which is distinct from the file-level 'read' and 'disk_read' siblings. The parenthetical ties it to a concrete forensic workflow, so an agent knows roughly what it returns. It stops short of explicitly contrasting itself with disk_read/read.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives a clear triggering context: use this to follow up hits from grep_unallocated. That is genuine routing guidance, not merely implied usage. However, it offers no when-not guidance and does not say how it relates to the similar disk_read or read tools.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden. It does disclose the return shape (hex dump or text) and that the offset is absolute, but says nothing about safety/read-only status, behavior on out-of-range offsets, partial reads, or default length of 512.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

A single short clause with no wasted words and the key notion (raw bytes at absolute offset) front-loaded, but the brevity comes at the cost of under-specification rather than efficiency.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 4-parameter, no-annotation, no-output-schema read tool, the description is too thin: it lacks first-call prerequisites, default length behavior, and disambiguation from sibling read/block_read tools.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% for 4 parameters. The description clarifies 'offset' as absolute and hints at 'as_text' via 'hex dump or text', but leaves 'image' and the 'length' parameter (default 512) entirely unexplained, so it only partially compensates.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The fragment 'Raw bytes at an absolute byte offset in the image' implies a read operation and names the resource (raw image bytes), but omits the verb and offers no contrast with siblings such as block_read or read, which an agent could easily confuse it with.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this versus block_read, read, strings, or extract; the only implied usage cue is 'absolute byte offset', with no when-not conditions or prerequisites (e.g., image must be opened first).

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full behavioral burden. 'Dump rows' implies a read operation, but the description does not state permissions, error behavior, return format, whether the operation is read-only, or how the limit is applied.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single front-loaded sentence with no filler. The parenthetical cleanly groups optional column selection and text filtering, though it remains quite terse for an 8-parameter tool.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool has 8 parameters, 0% schema description coverage, no annotations, and no output schema. The one-sentence description covers the core operation but does not explain the source-selection parameters or the default row limit, leaving the definition materially incomplete for correct invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% across 8 parameters. The description gives meaning to table, columns, and contains, but leaves ref, part, image, limit, and local_path unexplained, which is a substantial gap for a tool with no schema-level parameter documentation.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource: dump rows of an ESE database table. It also mentions optional column selection and text filtering. It does not explicitly distinguish itself from the sibling esedb_tables tool, but the row-level scope is clear.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage by saying it dumps rows with optional columns and a text filter, but it gives no explicit when-to-use guidance, prerequisites, or alternatives. It never mentions esedb_tables or explains when to choose this tool over listing tables.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full behavioral burden and discloses almost nothing: it does not say the operation is read-only, whether it requires the DB to be extracted/available locally, or what happens on an invalid or encrypted database. Naming the recognized ESE file formats is the only implicit signal that this is a non-destructive inspection step.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

A single front-loaded sentence with no filler; the artifact examples are compact and informative. It is efficient, though the space saved is spent on nothing that compensates for missing operational guidance.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool exposing four alternative source-selection parameters with no annotations and no output schema, the description leaves the agent unable to determine which parameter to supply or what the result looks like. Incomplete relative to the tool's actual complexity.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

All four parameters (ref, part, image, local_path) have 0% schema description coverage and are not addressed at all in the description, so an agent gets no help on how to point the tool at a database. The parenthetical file names give only a weak hint about what local_path/ref would reference.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (List) and resource (tables of an ESE database) and grounds it with concrete artifacts (SRUDB.dat, Windows.edb, WebCacheV01.dat, ntds.dit). It does not, however, distinguish itself from the obvious sibling esedb_dump (dump contents) or from the analogous sqlite_tables, so an agent must infer the boundary.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no when-to-use guidance, no mention of being a prerequisite step for esedb_dump, and no stated exclusions versus sqlite_tables. Usage is only implied by the verb 'List'.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It discloses the return format ('flattened event data') and implies read-only via 'Query', but does not state permissions, pagination/limit behavior, or explicit non-destructive safety.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

A single front-loaded sentence with no filler; each clause adds either filter capability or return-format information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 10-parameter forensic query with no annotations and no output schema, the description omits how to specify the .evtx source (local_path/ref/part/image) and gives no usage guidance, leaving key invocation details missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0% across 10 parameters. The description names filter categories (event IDs, time range, provider, text) but leaves ref, part, image, limit, and local_path unexplained, so an agent cannot fully determine source selection or pagination.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb ('Query') and resource ('Windows .evtx log'), and lists the main filter dimensions. Clear, but does not explicitly differentiate from sibling forensic tools such as timeline or find.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

No when-to-use guidance, no alternatives, and no prerequisites are provided. The resource implies the domain, but the description does not say when this tool is preferred over siblings or what source selection is required.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full behavioral burden. It discloses a fallback implementation (exiftool when installed, else Pillow EXIF and OOXML properties), but omits read-only nature, error handling, authentication needs, and output format.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, front-loaded sentence with no wasted words. The parenthetical adds relevant fallback information, though it could be slightly clearer about the action taken.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with four fully undocumented parameters, no annotations, and no output schema, the description leaves major gaps: parameter semantics, usage context, and return format are all missing. The brief implementation note does not compensate for these omissions.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% and the description mentions none of the four parameters (ref, part, image, local_path). Their meanings, expected formats, and mutual relationships are completely unexplained, leaving an agent unable to construct a correct call.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description states the resource (metadata of a media/document file) and hints at the tool's output, but uses no explicit verb and does not differentiate from siblings like file_info or office_parts. The parenthetical implementation detail helps a little but does not clarify the underlying purpose beyond the resource name.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no guidance on when to use this tool versus alternatives, no prerequisites, and no exclusions. The agent is left to infer its use from the name and sibling list.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries most of the burden. It usefully discloses that this is a copy-out (source image untouched) and that it returns size, SHA1, and MD5, compensating for the absent output schema. It omits overwrite behavior when files already exist in out_dir and any permission/error conditions.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

A single dense sentence, front-loaded with the action and destination, with the return values trailing. No wasted words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 6-parameter tool with no annotations and no output schema, the description covers return values and the out_dir path semantics, which is more than most. But it leaves half the parameters and file-existence/overwrite behavior unspecified.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% and there are 6 parameters, so the description must compensate. It clarifies out_dir ('relative to, or inside, the output root') and hints at ADS via 'stream', but leaves ref, name, part, and stream unexplained, which is a substantial gap for selecting the correct file/stream.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource: 'Copy a file (or ADS) out of the image into out_dir.' The destination (out_dir) implicitly separates it from read/ls/stat siblings, though no sibling is named explicitly.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no when-to-use guidance and no mention of alternatives. An agent must infer when to call extract versus read or disk_read rather than being told.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden, and it does disclose meaningful output behavior — hashing, entropy measurement, and detection of data hidden after JPEG/PNG/PDF end markers. However, it never states that the operation is read-only, nor does it clarify how the four input sources relate, leaving real behavioral gaps.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

A single compact sentence with the most distinctive capability (appended-data detection) front-loaded and no filler. It reads as a fragment rather than a sentence, but no words are wasted.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, no annotations, and 0% parameter documentation, the description should do more. It lists some returned fields but omits the return structure, the meaning of the four input parameters, and any safety profile for a tool that reads raw file bytes.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% across four parameters (ref, part, image, local_path), and the description says nothing about any of them. It does not explain that these are alternative ways to point at the target file, so the agent gets no help selecting the right input.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description names the specific outputs (file type, SHA1/MD5/SHA256, entropy, appended data past end markers), which makes the tool's function clear even without an explicit verb. It does not, however, distinguish this from siblings like stat, exif, or strings that also inspect a file.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no when-to-use guidance, no conditions, and no mention of alternatives such as stat or exif that overlap with file inspection. The agent must infer usage entirely from the tool name.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden, and it does disclose useful behavior: deleted-file scope is controllable (any|only|no) and time values are ISO in the image's timezone. It does not say whether the search is recursive across the whole image, how results are ordered, or how the default limit of 500 truncates output.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Three terse clauses, front-loaded with the primary verb and resource and with no filler. Density is high, though the telegraphic style ('deleted = any|only|no') trades some readability for brevity.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 10-parameter tool with no annotations, no output schema, and zero schema description coverage, one sentence of prose is thin. It omits result shape, pagination/limit semantics, size-filter units, and the meaning of 'part' and 'image', leaving an agent to guess on much of the invocation surface.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate. It usefully explains 'pattern' (glob with * ? or regex), the 'deleted' values, and the ISO/image-timezone format for the mtime bounds, but leaves 'image', 'part', 'limit', 'min_size', and 'max_size' entirely undocumented.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb+resource ('Find files by path name') plus the matching modes (glob with * ? or regex) and the notable scope of including deleted names. This clearly separates it from content-search siblings like grep_files, but it never names an alternative such as ls or recover_deleted, so sibling differentiation is implicit rather than explicit.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no when-to-use or when-not-to-use guidance. An agent cannot tell from the text when to prefer find over ls (single directory listing), timeline (chronological view), or recover_deleted (deleted-only recovery), even though 'including deleted names' hints at overlap with the latter.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It discloses only that results are offsets plus context; it says nothing about default limits (max_hits=200, context=100, ignore_case=true), encoding behavior, performance on large images, or what happens when no terms/ref are supplied despite every parameter being optional.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

A single front-loaded sentence with no filler, correctly sized for a one-line summary. It is efficient but so terse that it forgoes clarification an agent would need for a 10-parameter tool.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 10-parameter forensic search tool with no annotations, no output schema, and 0% schema coverage, the description is far too thin. It omits how to combine inputs (ref+part+image vs local_path), the meaning of the parameters, and any behavioral expectations.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% across 10 parameters. The description adds meaning for ref vs local_path and alludes to 'context', but leaves part, image, regex, terms, max_hits, encodings, and ignore_case completely unexplained in both schema and prose.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (search) and resource scope (one file) and clarifies the two file sources (in-image ref or local_path to an extracted file). The singular 'one file' implicitly distinguishes it from the sibling grep_files, though that sibling is never named, so differentiation requires inference.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is only implied by the 'one file' scope and the ref-vs-local_path distinction. There is no guidance on when to choose this over grep_files, grep_unallocated, strings, or find, nor any stated prerequisites or exclusions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden. It usefully discloses that this is asynchronous ("Background job") and must be polled via job_result, plus which encodings are searched. It does not mention result caps/truncation behavior or permission/scope constraints.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Two tight sentences with the core scope front-loaded and the async workflow instruction last. No filler, though it is arguably too terse for an 11-parameter tool.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An 11-parameter background-job tool with no annotations and no output schema needs far more than two sentences. The description neither covers the tuning parameters nor explains the shape of the job result the agent is told to poll.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% across 11 parameters, so the description must compensate and largely does not. It explains path_regex and implies terms/encodings, but max_hits, max_files, max_file_mb, include_deleted, part, image, regex, and ignore_case are all undocumented.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb+resource: search file CONTENT of files whose path matches path_regex. It also flags the background-job nature and encodings covered. It stops short of explicitly differentiating from the close siblings grep_file and grep_unallocated, which an agent must infer.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

"Poll job_result" gives a concrete follow-up instruction for the async workflow, which is genuinely useful. However, there is no guidance on when to choose this over grep_file, grep_unallocated, find, or strings, so selection among the grep family is left to inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden. It usefully discloses the async nature and that hits carry file-system block numbers (or blkls offsets under sleuthkit), which is real behavioral context. It says nothing about safety, permissions, resource limits, or the effect of max_mb/max_hits.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

A single front-loaded sentence that opens with the key fact ('Background job') and stays tight. The semicolon-heavy packing is slightly dense but nothing is wasted.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 9-parameter async job with no annotations and no output schema, the description covers the async model and result format but omits parameter semantics, safety profile, and any notion of limits or failure modes. Substantial gaps remain.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0% across 9 parameters, so the description should compensate but does not. Only 'terms' is implicitly covered; part, regex, max_mb, context, max_hits, encodings, ignore_case, and image are undocumented anywhere, leaving the agent guessing at their meaning and defaults.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource: 'scan unallocated space for terms'. This is meaningfully different from the grep_files/grep_file siblings, which operate on files, but the description never names those siblings to make the distinction explicit.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

'Background job' plus 'Poll job_result' tells the agent this is asynchronous and how to retrieve results, which is useful workflow guidance. However, it never says when to choose this over grep_files/grep_file or strings, leaving the selection to inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full behavioral burden; it usefully discloses the allowed_roots / FEA_UNRESTRICTED permission gate. However it does not say that registration is a state-changing operation that persists, what happens on duplicate names, or how failures surface.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Two efficient sentences with the core action and supported formats front-loaded, followed by the eligibility constraint. No filler, every clause carries information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 4-parameter, no-annotation, no-output-schema tool, the description covers purpose and the permission gate but omits the semantics of label and timezone, duplicate-name behavior, and whether a registration handle/ID is returned.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%, so the description must compensate. It only loosely covers two of four parameters ('short name' for name, image formats for path) and says nothing about label or timezone, leaving half the parameters undocumented in both schema and prose.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description gives a specific verb and resource ('Register a disk image') plus the supported image formats (raw, split raw .001, E01) and the name binding. It does not explicitly contrast with the closest sibling images_list, which lists rather than registers images.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

It states an explicit precondition (paths must be under allowed_roots, or FEA_UNRESTRICTED=1 must be set) and names the fallback when that condition fails (register on the host with `fea images add`). This is a clear when-to-use and when-not-to-use with an alternative route.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full behavioral burden. It usefully discloses the return contents (name, path, label, timezone plus the default timezone), which the agent would otherwise have to guess since there is no output schema. It says nothing about whether this is read-only, auth requirements, or behavior on an empty registry, leaving a gap for a no-annotation tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

A single sentence, front-loaded with the action and resource, with the returned fields parenthesized compactly. No wasted words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no annotations and no output schema, the description does the essential work by naming the fields returned. For a simple, side-effect-free zero-argument list tool this is close to sufficient; only edge-case behavior (empty registry, ordering) is unaddressed, which is minor here.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool takes zero parameters and the schema is an empty object, so there is no parameter semantics to explain. Per the baseline for zero-parameter tools, a 4 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description gives a specific verb and resource ('List registered disk images') and even enumerates the fields returned (name, path, label, timezone). It is clearly distinguishable from the closest sibling, images_add, but it never explicitly differentiates itself from other list-style tools (jobs_list, etc.). Clear purpose, no active sibling routing.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no explicit when-to-use or when-not-to-use statement and no mention of images_add as the alternative. Usage is only implied by the purpose: for a zero-parameter listing tool the invocation context is fairly self-evident, so a 3 rather than a 2.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full behavioral burden. It usefully discloses that cancellation is cooperative and occurs at the next progress checkpoint, implying it is not an immediate kill. It omits other important traits such as permissions required, behavior if the job is already finished, idempotency, or what the tool returns.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single front-loaded sentence with no wasted words. It immediately communicates the action, target, and key constraint.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple one-parameter tool with no annotations and no output schema, the description conveys the core action and the cooperative cancellation behavior. However, it does not explain the required job_id parameter, where to find it, or what happens on error or completion, leaving some gaps for an agent to infer.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% for the single required parameter job_id. The description does not mention this parameter, explain how to obtain it, or clarify its format or source, so it fails to compensate for the missing schema documentation.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb ('stop') and resource ('running background job') and adds a key qualifier ('at its next progress checkpoint'), making the tool's purpose clear. It separates itself from siblings like job_status and job_result by focusing on cancellation, though it does not explicitly name those alternatives.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The phrase 'running background job' implies the tool should be used only for jobs still in progress, which is useful context. However, the description does not state when not to use it, does not mention alternatives such as job_status for checking progress, and provides no prerequisites beyond the implied running state.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description discloses the waiting behavior and a maximum wait time (300 seconds), which is useful behavioral context. However, with no annotations, it does not explain what happens if the job is not done after wait_s (timeout behavior), whether the call is read-only, or how errors are handled.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, front-loaded sentence with no wasted words. It efficiently conveys the core behavior and a key constraint.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple two-parameter tool with no output schema or annotations, the description covers the basic purpose and wait constraint. However, it omits important context such as what job_id refers to, what happens on timeout, and the format or content of the returned result.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 0% schema description coverage, the description compensates partially by explaining that wait_s is in seconds and capped at 300. It adds no meaning for job_id beyond the schema title, leaving the identifier's source and format unspecified.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb (wait), resource (background job), and outcome (return result), making it clear what the tool does. It does not explicitly differentiate from sibling tools like job_status or job_cancel, though the name and description imply distinct functionality.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

No explicit when-to-use or when-not-to-use guidance is provided. The description implies usage after starting a background job, but does not mention alternatives such as job_status for polling without waiting, leaving the agent to infer the appropriate context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full behavioral burden, and it discloses almost nothing: no statement that this is a read-only/non-mutating call, no ordering, pagination, or whether completed jobs remain listed. For a job-listing tool with zero annotation coverage this is a notable gap.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

A single tight sentence with the scope constraint front-loaded and no wasted words. Appropriately sized for a zero-argument list tool.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple 0-param lister this is close to adequate, but with no output schema the agent gets no hint of what a job entry contains or whether results are ordered or limited. A brief note on return shape would complete it.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool takes no parameters, so the baseline is 4; there is nothing for the description to clarify or compensate for.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('List background jobs') plus a scope qualifier ('started in this session'), which is more than a restatement of the name. It does not explicitly distinguish itself from the sibling job_status, job_result, and job_cancel tools, so an agent must infer the division of labor.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The phrase 'started in this session' implies scope and therefore when the tool applies, but there is no explicit when-to-use guidance or reference to the sibling job_status/job_result tools that retrieve per-job detail. Usage is implied rather than stated.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full disclosure burden. It implies a non-destructive read, but says nothing about polling cadence, terminal states, whether progress is monotonic, or what happens when the job_id is unknown or expired.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

One short sentence with no filler and the key concept front-loaded. It is a noun phrase rather than a verb-led sentence, which slightly weakens the phrasing but the size is appropriate.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a job-query tool with no output schema, no annotations, and an undocumented required identifier, the definition is too thin. An agent cannot tell how to obtain a valid job_id or what the response contains, so it is not complete enough to call confidently.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% and the description adds nothing about job_id: its format, whether it is the same identifier returned by job submission or jobs_list, or whether it must be currently running. With the single required parameter undocumented in both places, the description fails to compensate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a clear resource (background job) and the specific information returned (status and progress), so an agent knows this is a read of job state rather than a listing or result fetch. However it offers no differentiation from close siblings like job_result, job_cancel, or jobs_list, leaving the agent to infer the boundary.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no when-to-use guidance, no statement of when this beats job_result or jobs_list, and no prerequisites. The only implied context is that a job must already exist.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full behavioral burden. It usefully enumerates what gets extracted (target path, volume serial, machine id, target times), implying a read-only parse, but it never explicitly states read-only behavior, error handling, or required permissions.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

A single tight sentence with the key resource and output fields front-loaded; no filler. The trailing field list is slightly terse but every clause earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

No output schema and no annotations, so the description's list of extracted fields is genuinely useful return-value context. However, with four fully undocumented parameters and no usage guidance, it is not complete enough for the agent to invoke the tool confidently.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% across four parameters (ref, part, image, local_path), and the description explains none of them. It adds domain context about the tool overall but zero per-parameter meaning, leaving the agent unable to know how to supply input.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description gives a specific verb ('Parse') and resource ('Windows shortcut (.lnk / Jump List entry)') and even enumerates the extracted fields. There is no lnk-specific sibling to differentiate from, so sibling routing is not required.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description states what the tool does but never says when to reach for it, what input form is expected, or what alternatives exist among the many forensic siblings (file_info, stat, timeline). No usage context is provided.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden. It does disclose return content (names, inodes, sizes, MAC times, deleted flags, alternate data streams), which is useful behavioral context, but it does not state read-only safety, image/part requirements, pagination or limit behavior, or side effects.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single front-loaded sentence that immediately states the action and then enumerates the key output fields. There is no wasted wording or redundant framing.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a five-parameter forensic listing tool with no annotations, no output schema, and 0% schema description coverage, the description is materially incomplete. It explains some output attributes but leaves required parameters, optional parameters, limit behavior, and safety expectations undocumented.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate for five undocumented parameters. It partially clarifies the path parameter with the 'path or inode:N' syntax, but image, part, limit, and show_deleted are not explained at all.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource: 'List a directory,' and adds the path/inode input syntax plus the listed attributes. It clearly distinguishes this as directory enumeration rather than file reading, extraction, or single-file stat, but it does not explicitly name or route to sibling alternatives.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives only implied usage by saying it lists a directory and accepts a path or 'inode:N'. There is no explicit when-to-use guidance versus alternatives like find, stat, read, or extract, and no stated preconditions or exclusions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided, so the description carries the full behavioral burden. It discloses output content (parts, text, comments, properties, hidden text, tracked changes) but says nothing about read-only safety, side effects, permissions, rate limits, or pagination.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Single sentence, front-loaded with the core action, and no filler. Every clause adds information about capabilities or scope.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with 5 undocumented parameters, no annotations, and no output schema, the description is insufficient. It covers what the tool does but omits how to invoke it (e.g., selecting a part, using ref vs local_path) and what to expect from the response.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% for all 5 parameters (ref, part, image, max_chars, local_path), and the description does not explain any parameter or their roles. No meaning is added beyond the bare schema names.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

States specific resource (OOXML document: docx/xlsx/pptx) and multiple actions (list parts, extract text, comments, properties; flag hidden text and tracked changes). This distinguishes it from generic file tools in sibling list, though it doesn't explicitly name alternatives.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

No when-to-use guidance, prerequisites, or alternatives mentioned. The opening phrase implies use for OOXML documents, but there is no explicit context for selecting this tool over siblings like extract or read.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries full behavioral burden. It mentions FS-type probing as a method but does not state that the operation is read-only, whether it requires special permissions, or what the output looks like.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, front-loaded sentence with no wasted words. It is appropriately sized for a highly specific tool, even if additional information would be useful.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the lack of annotations, no output schema, and zero parameter coverage, the description is too sparse. It does not clarify the image parameter, the return format, or the read-only nature of the operation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, and the description never explains the required 'image' parameter. The agent can infer it is a disk image from the parameter name, but no format, path, or expected input details are provided.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description identifies a specific resource ('partition table') and method ('mmls-style' with file-system type probing), which distinguishes it from general filesystem listing siblings like ls or stat. However, it does not explicitly contrast itself with sibling tools such as disk_read or block_read.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

No when-to-use, when-not-to-use, or alternative-tool guidance is provided. The description only implies that this tool is for examining partitions, leaving routing decisions to the agent's inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations and no output schema, the description carries the full behavioral burden. It does usefully disclose the return content (run count, last 8 run times, volumes, referenced files), which partially substitutes for the missing output schema, but it says nothing about input handling, errors, or permissions.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

A single front-loaded sentence with zero waste; the resource comes first and the extracted fields follow in a compact list. Nothing needs trimming.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Four optional, undocumented parameters and no output schema leave the actual invocation path unclear — an agent cannot tell from the description which of ref/part/image/local_path to use. It compensates slightly by describing the returned fields but not enough for a tool this underspecified.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% and the four parameters have cryptic names (ref, part, image, local_path) with no descriptions. The description must compensate but does not: it never explains whether these are alternatives, what 'part' means, or how the .pf file is actually supplied.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource — 'Parse a Windows Prefetch (.pf) file' — and enumerates the fields it extracts (executable, run count, run times, volumes, referenced files). The resource is unique among the artifact-parser siblings (lnk, evtx, registry_key), so it is inherently distinguishable, but the description never explicitly contrasts itself with those siblings.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no when-to-use guidance, no prerequisite, and no reference to alternatives such as the lnk or evtx parsers. The agent must infer usage purely from the artifact name.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the burden. It usefully discloses the 4 MiB size cap, auto UTF-16 detection, hex output mode, and ADS support via stream. It does not explain how offset/length interact with the cap, permissions, or the return payload shape.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

A single dense sentence with the primary action and the key constraints front-loaded. No filler or redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 7-parameter tool with no annotations and no output schema, the description covers the read semantics but omits the identity parameters (image, ref, part) that every call requires and the pagination parameters (offset, length). Adequate but with real gaps.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0% across 7 parameters, so the description must compensate. It clarifies stream (selects an alternate data stream) and as_text (text vs hex), but leaves image, ref, part, offset, and length unexplained, so half the surface is undocumented.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (read) and resource (a file), plus scope (up to 4 MiB) and format options (text/hex, ADS via stream). This implicitly distinguishes it from block_read/disk_read raw-device readers, but no sibling is named explicitly.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no explicit guidance on when to use this versus alternatives like extract, strings, block_read, or disk_read. The 4 MiB cap hints that larger content should go elsewhere, but that inference is left entirely to the agent.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description must carry the full load; it usefully discloses the async job model and that output is confined to out_dir inside the output root. It says nothing about whether the source image is modified, what happens when max_files is hit, or error/failure behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Two dense sentences with the job model front-loaded and no filler. It is arguably over-compressed — 'Poll job_result' assumes the reader already knows job_result takes a job id.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 5-parameter background-job tool with no annotations, no output schema, and 0% schema coverage, the description covers the async workflow and the output-location safety constraint but leaves three parameters (image, part, max_files) undocumented. Adequate framing, incomplete parameter coverage.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate, but it only clarifies out_dir (relative to the output root) and the optional path_regex filter. The required 'image' parameter and the 'part' and 'max_files' parameters get no explanation anywhere.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('recover deleted/orphaned files') plus the destination constraint ('into out_dir, inside the output root'). It is clearly distinguishable from sibling tools like extract or find, though it never names an alternative to contrast against.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The phrase 'Background job ... Poll job_result' tells the agent this is asynchronous and which sibling to poll, which is real usage guidance. However, there is no statement of when to prefer this over extract/find or any prerequisite/exclusion conditions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden of behavioral disclosure. It does reveal output content and a depth cap of 4, but says nothing about how a hive is sourced (image vs local_path vs ref/part), permission requirements, error behavior when a key is absent, or truncation via max_values.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

A single well-formed sentence with the read scope and hive list front-loaded and no filler. It is efficient, though the brevity is partly under-specification rather than tight editing.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 7-parameter, 0%-schema-coverage tool with no annotations and no output schema, the description omits too much: the hive-source mechanism, the role of ref/part, and the max_values cap are all unexplained, so an agent cannot confidently construct a valid call.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% across 7 parameters, so the description must compensate and largely does not. It gives meaning only to 'depth' (max 4) and implicitly to 'key'; the critical image/local_path/ref/part source-selection parameters and max_values go undefined anywhere.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb ('Read') and resource (a Windows registry hive), enumerates the hive types (SYSTEM, SOFTWARE, SAM, NTUSER.DAT, UsrClass.dat, Amcache.hve) and names the returned artifacts (values, last-write time, subkeys). It does not explicitly distinguish itself from the sibling registry_plugins, so it falls just short of 5.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to reach for this tool versus registry_plugins or the generic read/stat/extract tools. It never explains which hive should be paired with which of image/local_path/ref/part, leaving selection entirely to inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full behavioral burden, and it discloses almost nothing: it does not state that the operation is read-only, what a 'hive' input actually is, how outputs are shaped, or any failure modes. The only behavioral hint is the phrase 'on a hive'.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

A single front-loaded sentence with no filler; the parenthetical list of plugin names is the only elaboration and it earns its place by defining scope. It stops short of being bloated.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no annotations, no output schema, five undocumented parameters, and no usage guidance, the definition is not complete enough for an agent to call this tool confidently. At minimum it needs to explain what ref/image/local_path mean and how they relate.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% across five parameters, so the schema provides no help. The description gestures at 'hive' and 'plugins' but leaves ref, part, image, and local_path completely unexplained, including whether ref is an image reference or a local file path.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Run regipy artefact plugins on a hive') and enumerates concrete plugin names (UserAssist, ShellBags, USBSTOR, services...), so an agent knows exactly what class of output to expect. It does not explicitly contrast itself with the sibling registry_key tool, which also operates on hives.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is implied by the plugin enumeration (forensic artefact extraction from a registry hive), but there is no explicit when-to-use statement and no guidance on choosing this over registry_key for raw key reads. Nothing is misleading, but the agent must infer the selection criteria.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden, and it does disclose one important trait: the operation is read-only ('read-only SELECT'), so an agent knows it will not mutate the database. However, it says nothing about the implicit limit (default 200), error behavior on non-SELECT statements, or permissions.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

A single tight sentence with the verb front-loaded and zero filler. It is appropriately sized, though its brevity is partly under-specification rather than pure efficiency.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with six parameters, no output schema, and no annotations, the description is thin: it omits how the target database is located (ref/part/image/local_path), the row-limit behavior, and error semantics. It is not complete enough to invoke confidently without inspecting the schema.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% and no parameters are explained. 'Inside the image' loosely hints at the `image` parameter and 'SELECT' maps to `sql`, but ref, part, limit, and local_path — the ambiguous ones governing which database is targeted — are left entirely undocumented.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (run) and resource (a read-only SELECT against a SQLite database inside the image), which is enough to distinguish it from the listing-oriented sibling sqlite_tables. It stops short of naming any sibling explicitly or scoping the query targets, so it is clear but not maximally differentiating.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The phrase 'read-only SELECT' implies the tool is for retrieving rows, but there is no explicit when-to-use, when-not-to-use, or reference to alternatives such as sqlite_tables for schema discovery. An agent must infer the workflow entirely.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden. It does disclose one useful trait (WAL is applied when present) and reveals it is a read-style inspection, but it says nothing about permissions, whether it mutates anything, or how the source database is selected, leaving major behavioral questions unanswered.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

A single efficient sentence with the core output list front-loaded and no wasted words. It is terse to the point of omitting needed detail, but it is structurally clean.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no annotations, no output schema, and four fully undocumented source-selection parameters, the definition is not complete enough for an agent to call it correctly. The description should at minimum explain how the database reference/part/image/local_path are used.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% and all four parameters (ref, part, image, local_path) are undocumented in both the schema and the description. An agent cannot tell how to point the tool at a database or which of the mutually-exclusive source parameters to use.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description names the resource (SQLite database) and enumerates the concrete outputs (tables, row counts, columns, freelist size), giving a clear picture of what the tool returns. It does not, however, distinguish itself from the sibling sqlite_query, which is the nearest alternative.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no guidance on when to use this tool versus sqlite_query, nor any prerequisites or exclusions. The parenthetical examples (browser history, chat apps, Android apps) hint at intended targets but do not constitute usage direction.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden and does reasonably well: it discloses the returned fields (times, attributes/ADS, NTFS $FILE_NAME times, timestomp indicator) and a conditional behavior (istat text only when sleuthkit is installed). It omits that the operation is read-only and any failure modes for bad paths/inodes.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

A single front-loaded sentence that packs the identifying formats and the return contents without filler. It is dense with forensic jargon but every clause carries information; no wasted sentences.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

No output schema and no annotations, so the description has to do more. It covers the return contents well but leaves 'image' and 'part' semantics unexplained and gives no guidance on selecting this over sibling tools, leaving an agent with an incomplete picture.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate. It does explain the 'ref' formats ('inode:N', 'N-128-3'), which is real added value, but 'image' and 'part' receive no explanation at all, leaving half the parameters undocumented.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

States a concrete action (return full metadata) against a specific resource (file/dir), and pins down the two ways to identify it: path or inode. This differentiates it from siblings like ls (listing) and file_info, though it never names those alternatives explicitly.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no when-to-use guidance and no comparison to the many sibling metadata/listing tools (ls, file_info, timeline). The agent must infer from 'Full metadata' alone that this is the deep single-entry inspection tool rather than a listing.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations and no output schema, the description carries the full behavioral burden. It does disclose the output shape (strings with offsets) and supported encodings, but says nothing about permissions, whether the source file must be opened/attached first, result ordering, or truncation when limit (default 500) is hit.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

A single front-loaded sentence with no filler; the core action and the two notable capabilities (offsets, regex filter) come first. It is arguably over-terse for an 8-parameter tool, but there is no wasted text.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For an 8-parameter forensics tool with no annotations, no output schema, and no parameter descriptions, the description is far too thin. Critically, it never explains how to designate the source (ref/part/image/local_path), which is the first thing an agent must get right to call this successfully.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% across 8 parameters, so the description must compensate. It maps loosely to two of them ('filtered by regex' -> pattern, 'ASCII and UTF-16LE' -> encoding), but the six source- and sizing-related parameters (ref, part, image, local_path, limit, min_len) are unexplained in both schema and description.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific operation and resource: extract printable strings from a file, with offsets, covering ASCII and UTF-16LE. This is clear enough to act on, but it never names the closely related siblings (grep_file, grep_files) to distinguish this from regex search tools in the same family.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The word 'optionally' implies a filtering mode but gives no when-to-use guidance, no prerequisites, and no routing to alternatives such as grep_file for pattern matching or read/extract for raw content. The agent must infer the tool's niche from the name alone.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full behavioral burden, and it does add one useful detail: start/end are ISO timestamps interpreted in the image timezone. However, it omits whether the tool is read-only, how results are ordered or paginated, and what the cryptic kinds letters actually mean, leaving a mutation-free forensic read largely undescribed.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

A single dense sentence with the core concept front-loaded and no filler. It is terse to the point of omitting needed detail, but nothing in it is wasted.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For an 8-parameter forensic tool with no annotations, no output schema, and 0% schema coverage, the description is too thin. It leaves the required image argument, part/limit/include_deleted semantics, and the meaning of the kinds codes unexplained.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate for all 8 parameters, but it only touches start, end, path_regex, and kinds. The required image parameter, plus part, limit, and include_deleted, receive no explanation anywhere, and the kinds values 'm a c b' are listed without defining the MACB semantics.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource: a file-system timeline built from a directory walk, scoped by start/end. An agent can tell it produces a chronological view rather than a flat listing, though it never explicitly contrasts itself with close siblings like find or ls.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

No when-to-use guidance is given, and no alternative is named. It is unclear when an agent should pick timeline over find, ls, stat, or grep_files for filesystem exploration, leaving selection entirely to inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It usefully discloses the returned contents (platform, Python version, optional native tools, access policy), which partially compensates for the missing output schema, but it never states that this is a side-effect-free read or whether the policy check has any cost or prerequisite.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

A single compact sentence-fragment with no padding, and the most decision-relevant item (available native tools) is listed early. It loses a point only for being a fragment that omits the verb that would state the action.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a zero-param status tool with no output schema, enumerating the return contents is genuinely helpful. However, 'the host access policy in force' is left undefined, and the description omits the key operational fact an agent needs: that this should be consulted before invoking tools that depend on sleuthkit, exiftool, or host read access.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool takes zero parameters and the schema is empty, so there is nothing for the description to clarify. Baseline 4 applies; no parameter confusion is possible.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description enumerates the specific resources reported: platform, Python version, optional native tools (sleuthkit, exiftool), and the host access policy. That is concrete and clearly distinct from the analysis siblings (ls, stat, yara_scan). It is a noun-phrase fragment with no verb, so the agent must infer it is a status/query tool rather than being told.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no when-to-use guidance at all. An agent is not told to call this first to discover whether sleuthkit or exiftool-backed tools (extract, exif, timeline) are actually available, nor that the host access policy constrains what other tools can read. The only usage signal is implied by the content list.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It hints at a 'allowed roots' path restriction, which is useful, but says nothing about whether the scan is read-only, what the match output looks like, or how ref/part/image select the target. For an unannotated tool this is a significant gap.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

One tight sentence with the core operation front-loaded and no filler. Brevity is appropriate, though the parenthetical is doing work that belongs in parameter documentation.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Five undocumented parameters, no annotations, and no output schema mean the description is the only source of guidance — and it covers roughly one parameter. The ref/part/image combination is central to how this tool targets data and is left completely unexplained.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0% across 5 parameters, so the description must compensate and does not. It addresses 'rules' (rule text or .yar path) and loosely the file target, but leaves ref, part, image, and local_path entirely undefined — an agent cannot tell how to point the scan at a disk image versus a filesystem path.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (scan) and resource (file) with the YARA rule mechanism, and no sibling tool competes in this space. It does not explicitly differentiate itself from the grep_* family, but the YARA-specific purpose is unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this over grep_files/grep_file/grep_unallocated, which are the natural alternatives for pattern matching. The parenthetical about rule text vs .yar path is a parameter detail, not a usage condition or exclusion.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.