otx_pivot_domain

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the burden of explaining behavior. It clearly states the tool returns pulse context, passive DNS history, attributed actors, and malware families, which implies a read-only enrichment lookup. It does not discuss rate limits or failure behavior, but for a simple lookup the return behavior is adequately disclosed.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

A single sentence covers purpose and output categories with no filler. The key resource ('domain') and result types are front-loaded, making it easy for an agent to parse quickly.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool is a simple one-parameter lookup with no output schema; the description compensates by listing the main output categories. It is largely complete for invocation purposes, though explicit guidance about sibling tools would make it fully self-contained.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema already provides 100% coverage with 'Domain or hostname to enrich', so the description adds little parameter-level detail beyond repeating 'domain'. Baseline 3 is appropriate because no additional semantics are needed.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific operation ('OTX enrichment for a domain') and lists concrete result categories: pulse context, passive DNS history, attributed actors, and malware families. This makes the tool's scope clear and distinguishes it from the IP/hash/URL pivot siblings.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The phrase 'for a domain' implies when to use it, and the schema constrains the input to a domain/hostname. However, it does not explicitly state when to prefer this over related pivots (otx_pivot_ip, otx_pivot_url, otx_pivot_hash) or name alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.