urlhaus_lookup_host

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations present, the description carries the full disclosure burden. It accurately conveys the lookup action and input scope, but does not mention result format, pagination, exact-match behavior, or whether live URLhaus data is queried. This is adequate but not rich.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

A single, information-dense sentence that states the action, resource, input scope, and data source. There is no redundancy or filler, and the core purpose is front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple one-parameter lookup tool, the description is largely complete: it explains what the tool does, what input it accepts, and what output to expect. Minor gaps, such as response shape or result limits, are acceptable for a low-complexity tool with no output schema.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, and the schema already defines host as an IP or domain with examples. The description repeats this semantics but adds no additional details such as accepted formats, validation rules, or special host syntax, so it remains at the baseline.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('Find') and identifies the resource: malicious URLs hosted on an IP or domain in URLhaus. This clearly differentiates it from urlhaus_lookup_url and urlhaus_lookup_tag while being immediately understandable.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies the appropriate context: when an analyst has an IP address or domain and wants associated malicious URLs. However, it never explicitly states when to prefer this tool over alternatives like urlhaus_lookup_url or when not to use it.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.