explain_firewall_change

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full behavioral burden. It reveals non-obvious behavior: changes are keyed by uuid to avoid confusing edits with delete-plus-add, save-stamp noise is recognized and set aside, and risk ratings include their stated grounds. It does not discuss permissions, limits, or side effects, but as a read-style explainer the disclosed detail is strong.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The main capability is front-loaded and every clause in the description carries high-signal information: uuid keying, plain-English rule explanations, risk grounds, shadowed-rule notes, API attribution, and save-stamp noise handling. There is no filler or repetition of schema field names.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a complex analysis tool with no annotations and no schema descriptions, this description covers the core domain, key behaviors, and important output semantics well. The main missing context is the 'device' parameter and explicit routing among sibling diff tools, so it falls just short of fully complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate. It indirectly defines 'before' and 'after' as OPNsense config.xml captures, but it never explains the optional 'device' parameter or how it relates to attributing 'which API call made the change'. With three parameters and zero property descriptions, this is a significant gap.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'Explain a change between two OPNsense config.xml captures rule by rule'. It then enumerates distinct output facets such as added/removed/edited/moved rules, risk ratings, shadowed-rule notes, and API attribution, clearly differentiating it from generic siblings like explain_config_diff.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The intended context is implied by 'OPNsense config.xml' and the firewall-rule focus, but the description never explicitly states when to use this tool versus alternatives. It also does not name a sibling tool or provide any when-not-to-use guidance, so the agent must infer the boundary with generic config diff tools.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.