Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description transparently discloses that it is destructive and requires an explicit environment variable, matching the annotations (readOnlyHint=false, destructiveHint=true). It also warns about irreversible network impact, which is more detailed than the bare annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences, with the purpose front-loaded and no redundant information. Every sentence adds value, including the risk warning and required environment variable.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description conveys the essential context for a risky write operation: the purpose, the requirement for WAZUH_ALLOW_WRITE=true, and the need for human confirmation. Since an output schema exists, return values are not required, and the description suffices for agents to understand the tool's role.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema covers all four parameters with descriptions, so the baseline is 3. The description does not add significant extra parameter detail beyond the examples already in the schema; the 'arguments' example is echoed from the JSON schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool executes an active-response command on agents and provides concrete examples (blocking an IP, disabling an account). It uses a specific verb and resource, distinguishing it from read-only sibling tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

It explains that the tool changes production state and can cut off network access, and instructs that it requires WAZUH_ALLOW_WRITE=true and human confirmation before use. However, it does not explicitly contrast with sibling action tools like wazuh_restart_agents, so the when-to-use guidance is partially implicit.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint, idempotentHint, and destructiveHint false. The description adds that it reads the configuration 'actually loaded' by the agent, which is a behavioral nuance implying it returns the effective runtime state, not just the configured value. This goes beyond the annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two concise sentences plus a short list of common pairs. No redundant wording, no filler. Every sentence adds value: the first states the action, the second gives motivation, and the list provides practical examples.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's simplicity, output schema presence, and clear parameter descriptions, the description adequately covers purpose, usage context, and parameter behavior. There is no obvious missing information that would prevent correct invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema covers all three parameters with descriptions (agent_id, component, configuration) at 100% coverage. The description adds concrete example values and pairing guidance (e.g., component='syscheck' configuration='syscheck'), which enhances the schema's basic descriptions and helps the agent pick correct combinations.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb 'Fetch' and the specific resource: 'the configuration a running agent has actually loaded for one module'. It also distinguishes from siblings like wazuh_get_agent (agent info) and wazuh_manager_config (manager config) by focusing on agent-applied configuration.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides clear context for when to use it: 'useful for confirming a group change or centralised config reached the endpoint'. It also gives common component/configuration pairs, which serves as practical guidance. It does not explicitly name alternative tools to avoid, but the context is strong.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The annotations (readOnlyHint=true, idempotentHint=true, destructiveHint=false) already cover the key behavioral aspects. The description adds no conflicting information and implicitly confirms read-only behavior by saying 'Read inventory'. No side effects are stated, but none are needed given the annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is only two sentences, yet it conveys the full scope (components, sample questions) without padding. It is well-structured for quick parsing and decision-making.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With an output schema present and the description covering usage and scope, the tool is adequately contextualized. It doesn't mention prerequisites like agent existence or error cases, but these are not essential given the schema and the tool's simplicity.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Descriptions for key parameters are helpful: query and search include concrete examples ('local.port=443', 'openssl'), agent_id and component are clearly explained, and sort describes the descending prefix. However, limit and offset lack descriptions, leaving a small gap in schema coverage (71%) that is not fully compensated.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

States the exact function—reading system inventory from an endpoint—and lists the specific components (packages, processes, ports, etc.). It also provides concrete example questions that clarify the tool's scope, distinguishing it from sibling tools focused on alerts, rules, or health.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly tells when to use the tool via example questions ('what is listening on this host', 'is package X installed', 'what patches are missing'). While it doesn't mention alternatives like wazuh_find_software or wazuh_get_agent, the usage scenarios are clear and actionable.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnly, idempotent, and non-destructive behavior. The description adds minimal extra transparency beyond noting it is an aggregation/health summary, which aligns with the annotations. No contradictions, but no significant additional behavioral context is provided.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two concise sentences with a clear structure: first listing the aggregated contents, then stating its primary use case. Every word serves a purpose; no fluff or redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with no parameters and a simple purpose, the description provides all needed context: what data is aggregated (connection states, OS, outdated versions, no-group agents) and what question it answers (deployment health). No output schema is present, but that is not required for this simple tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters, so schema coverage is effectively 100%. The description cannot add parameter-specific meaning, and the baseline for high coverage applies. No parameter details are needed or provided.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: aggregating agent fleet health including connection-state counts, OS distribution, outdated agents, and agents with no group. It explicitly positions it as 'the fastest way to answer how healthy is my deployment', distinguishing it from more detailed or specific tools like wazuh_list_agents or wazuh_health.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives implicit guidance by calling it 'the fastest way' to assess health, but it does not explicitly mention alternative tools or when to prefer them instead. The use case is clear, but there are no direct exclusions or comparisons to siblings, leaving the decision partially to inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The readOnlyHint and idempotentHint annotations already communicate that this is a safe, read-only operation, and the description does not contradict that. The description also clarifies it returns aggregated counts rather than raw alert data, adding useful behavioral context.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences long and packs the core purpose, example use cases, and a performance benefit without unnecessary detail. It is well-structured and easy to scan.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description gives enough context for an agent to decide when to use this aggregation tool and understand that it returns counts. It does not spell out the exact output shape, but the output schema is marked as available and the use cases make the expected result clear.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Several key parameters have useful descriptions, especially group_by with common field choices, start/end defaults, and top_nested. However, agent_id, severity, min_level, and rule_group lack descriptions, and the tool description itself only partially compensates. Schema coverage is 64%, so parameter semantics are adequate but not comprehensive.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool aggregates alerts by one or two fields and returns counts, with concrete example use cases such as 'top 10 rules today' and 'top source IPs per agent'. This makes the purpose distinct and immediately understandable.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides good usage guidance by listing common aggregation scenarios and explicitly notes that this is far cheaper than fetching alerts and counting them yourself. It does not directly name sibling tools like wazuh_search_alerts, but the use cases make the appropriate context clear.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations indicate read-only, idempotent, and non-destructive behavior, and the description clearly frames it as a read-only aggregation query. It does not describe output format, but the presence of an output schema and the straightforward read nature make the behavior sufficiently transparent.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is one concise sentence with useful examples and no filler. It efficiently communicates the core behavior and the optional split capability.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description provides enough context for a straightforward read-only aggregation tool, and the schema supplies defaults and constraints. It does not explain every filter parameter, but the overall purpose and usage context are clear.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Only 4 of 10 parameters have schema descriptions (end, start, interval, split_by), and the description does not compensate for the missing parameter semantics. Several parameters such as min_level, split_top, severity, and rule_group rely only on their names for meaning.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

States a clear, specific purpose: bucketing alert counts by time to show trends and spikes. Includes concrete example use cases and notes the optional split-by capability.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies temporal analysis use cases but does not explicitly contrast this with sibling tools such as wazuh_search_alerts or wazuh_alert_stats. It lacks guidance on when this tool is preferred over alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnly, idempotent, and not destructive, and the description adds that it is 'GET only, so it cannot change state.' This reinforces safety behavior beyond the annotations, though it does not describe edge cases like error handling or rate limits. Given the annotation coverage, this is more than sufficient.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two concise sentences with no fluff, front-loading the purpose and examples before the usage guidance. Every word adds value, and the structure is clean and scannable.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given that an output schema is present (per context signals), the description does not need to explain return formats. It covers the tool's role as a generic fallback, when to use it, and how it relates to siblings. A small gap is that it doesn't mention error handling or response shape, but that's covered by the output schema and annotation hints.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Both parameters are fully documented in the schema with descriptions and examples, achieving 100% coverage. The description adds no additional parameter info beyond what the schema already provides, so the baseline score of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose as an escape hatch for read-only Manager API endpoints, with concrete examples like '/agents/stats/distinct' and '/security/users'. It also explicitly contrasts with purpose-built siblings by saying 'Prefer the purpose-built tools when one fits,' which distinguishes it from other Wazuh tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly says to use this tool when no dedicated tool exists and to prefer purpose-built siblings when one fits. This gives clear when-to-use and when-not-to-use guidance, surpassing the basic schema info.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The annotations already declare the tool as read-only, idempotent, and non-destructive, which the description does not contradict. The description adds no extra behavioral context such as performance implications or rate limits, but given that the annotations cover the safety profile, a moderate score is appropriate. The description is consistent with the annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, well-structured sentence that conveys the core functionality without extraneous words. It includes relevant examples and clarifies the optional behavior, achieving high clarity in a compact form.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool is a simple read-only list operation, and the description covers the primary purpose and output. However, it omits details about the limit and offset parameters and does not describe the structure of the returned contents, which might be relevant for effective use. The presence of an output schema partially compensates, but the description alone leaves some gaps.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Only two of the four parameters (filename and include_contents) have descriptions in the schema, while limit and offset lack any explanation. The main description also does not elaborate on pagination or filtering semantics. This incomplete coverage leaves agents uncertain about the exact meaning and usage of the parameters.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description precisely states that the tool lists CDB lists, including their purpose in rules (e.g., known-bad IPs, allowed users, audit keys). It also notes the optional inclusion of contents, making the function unambiguous. This clearly differentiates it from other Wazuh list tools without needing further inference.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides no explicit guidance on when to use this tool versus sibling tools such as wazuh_list_rules or wazuh_list_agents. While the mention of 'used by rules' hints at a context, it does not name alternatives or specify conditions for selection. Agents would need to infer the appropriate tool from naming or external knowledge.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already indicate read-only and idempotent behavior. The description adds specific details about the returned information (enabled state, node roles, addresses, sync status, agent distribution), enhancing transparency without contradicting the annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, well-structured sentence that conveys all necessary information without redundancy or filler. It is appropriately concise for the tool's scope.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description fully explains what the tool returns, and the output schema is present to define the exact structure. No additional context is needed for an agent to use this tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema has no parameters, and schema description coverage is 100% (vacuously). The description adds no parameter information because none exist. This matches the baseline of 3 for high schema coverage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: providing a detailed cluster view including enabled status, node roles, addresses, and healthcheck output. It is distinct from sibling tools that handle alerts, agents, or vulnerabilities.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description inherently implies when to use it (when cluster status is needed) and contrasts with similar monitoring tools through its specific focus. However, it does not explicitly state alternative tools to avoid, though the sibling context makes this clear.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false, so the safety profile is covered. The description adds that it queries current state, which is consistent with the annotations but does not reveal additional behaviors such as rate limits or error conditions.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences long, front-loads the purpose, and provides practical examples without unnecessary detail or repetition.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description is complete for the tool's scope: it identifies the resource (FIM findings), the target (agent), the returned data categories, and typical use cases. Since an output schema exists, return-value details are not required for completeness.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 75%, so many parameters already have descriptions. The tool description adds clarifying examples and semantics (e.g., 'ssh' substring for search, exact monitored path, md5/sha1/sha256 digests, 'changed at least once since baseline'), which enriches parameter understanding beyond the base schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool queries File Integrity Monitoring state for an agent, listing what information is returned (files, registry keys, hashes, permissions, change count). It also gives concrete use cases ('was this binary modified', 'what changed in /etc') that distinguish it from general alert or agent tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides example questions the tool answers, giving implied usage guidance. However, it does not explicitly mention when not to use this tool or compare it with related tools like wazuh_search_alerts or wazuh_rootcheck, so guidance is present but not fully explicit.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint and idempotentHint. The description adds valuable behavioral detail: it returns matching package and version per agent, and it explains the agent_limit fallback when the fleet-wide endpoint is unavailable. This goes beyond the annotation baseline, though it doesn't specify error conditions or rate limits.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences, front-loaded with the action and use case, followed by the return value. No fluff or repetition. Every word adds information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers what it does, why it's used (vulnerability response), examples, and the output format. It also addresses edge behavior (fallback scanning). Combined with the output schema and annotations, an agent has all the necessary context to invoke this tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema descriptions cover all parameters 100% (package, version, limit, agent_limit) with clear meanings. The description adds a tiny bit of extra context for version ('Optional exact version') but largely repeats the schema. Since the schema is already thorough, a baseline score of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's primary function ('Search for a package across every agent at once') and gives concrete, recognizable examples ('which hosts have log4j installed'). It is distinct from sibling tools like wazuh_search_alerts or wazuh_list_agents, and the scope (fleet-wide) is unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly frames the tool for vulnerability response questions ('the tool for vulnerability response questions like...'), which tells an agent exactly when to invoke it. It also implies when not to use it (when a single agent is the target, other agent-specific tools would apply). The fallback behavior for agent_limit is described, giving practical guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The annotations already declare readOnlyHint, idempotentHint, and destructiveHint, covering safety implications. The description adds context about combining sources and producing a report, which is consistent with the annotations. No contradictions or extra side effects are mentioned.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with a clear summary and a bulleted list of report types. It avoids unnecessary fluff but is slightly lengthy due to the enumeration. Overall, it is concise and easy to parse.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity and the presence of an output schema, the description provides sufficient context: what it does, when to use it, and a list of report types. It doesn't explain the output format in detail, but the output schema covers that, so the description is complete enough.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema covers all parameters with descriptions, and the description adds meaningful semantics for 'framework' by stating it's required for compliance reports. This goes beyond the schema's basic description, improving parameter understanding.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: building a ready-to-share report by combining multiple Wazuh sources into one narrative with markdown rendering. It lists all report types and explicitly differentiates from sibling tools by saying 'Use this instead of stitching many tool calls together by hand.'

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides explicit usage guidance by directing users to use this tool instead of manually combining multiple tool calls. However, it doesn't enumerate specific scenarios beyond listing report types, so it's clear but not exhaustive.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnly and idempotent behavior, and the description aligns with these by describing a pure retrieval operation with no mention of side effects. The description reinforces the read-only nature without contradicting the annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences, efficiently listing what the tool returns and when to use it. No redundant or unnecessary words; the structure is well-organized and scannable.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple single-agent retrieval tool, the description adequately covers its function and usage context. No output schema is provided, but the description's promise of a 'full picture' is sufficiently clear for an agent to know what to expect.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema provides a thorough description of the agent_id parameter, including an example and the zero-padding rule. The tool description adds no additional parameter detail, but the schema alone offers high coverage, so the baseline is met and slightly exceeded by the helpful example.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool retrieves a comprehensive set of details for a single agent, including registration, connection state, OS, hardware, group membership, and installed-package count. It explicitly distinguishes itself from list-type tools by focusing on a specific agent.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The phrase 'Start here when investigating a specific endpoint' provides clear situational guidance. While it doesn't explicitly contrast with alternative tools, it strongly implies when this tool is the appropriate choice versus broader list or summary tools.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already indicate readOnly, idempotent, and non-destructive behavior. The description adds that it returns full XML definition but does not elaborate on side effects or operational nuances beyond the annotation coverage.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, focused sentence with no redundant information, making it easy for an agent to parse and apply.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description provides the tool's primary purpose and mentions the return content (full XML definition) sufficiently for an agent to decide when to call it, though it doesn't specify the exact output format.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The parameter rule_id is fully described with a concrete example ('5710'), which adds practical clarity beyond the schema's basic type definition.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action ('Fetch') and the resource ('a single rule') with the specific detail of including its full XML definition, which distinguishes it from listing tools like wazuh_list_rules.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage when a single rule's details and explanation are needed, but it does not explicitly state when to prefer this tool over alternatives such as wazuh_list_rules or wazuh_rule_groups.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already indicate read-only, idempotent, non-destructive behavior. The description adds context about the aggregated nature of the call ('one-call situational awareness'), which implies a broad data fetch. No contradictions with annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise, listing the key data points and usage hint in two sentences. It is well-structured and free of unnecessary details.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no parameters and a clear description of the returned information (manager health, daemon states, cluster, agents, indexer), the tool is fully specified for an agent to decide when to use it. No missing context.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters, so there is nothing to explain. The baseline score of 4 applies; the description correctly omits parameter details.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly specifies the tool's purpose: providing a comprehensive health snapshot including manager version/uptime, daemon states, cluster status, agent connection counts, and indexer health. It is distinct from siblings like wazuh_cluster_status or wazuh_manager_stats.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly states when to use: 'Call this first when asked is Wazuh healthy or when starting an investigation.' This gives clear guidance and distinguishes it from more specialized tools.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description reinforces the read-only nature by stating 'read-only _search' and 'Restricted to wazuh-* indices', which aligns with the annotations (readOnlyHint true, destructiveHint false). It adds the restriction context beyond the annotations, making behavior fully transparent.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise and well-structured: it opens with the core purpose ('Escape hatch'), then explains the scope and restrictions in two clear sentences. No unnecessary details or repetitions.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers the tool's purpose, usage context, constraints, and parameter behavior. Since an output schema exists, return value details are not needed, and the description is complete for an agent to select and invoke this tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Both parameters are thoroughly described. The body parameter includes an example and a best-practice note about setting a small 'size' unless aggregations are needed, while the index parameter explains the default and the required wazuh-* prefix. This goes well beyond the schema descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool sends a raw OpenSearch query DSL body to a Wazuh index, with a specific verb and resource. It also distinguishes itself from purpose-built alert tools by explicitly stating it handles anything they cannot express, such as unusual aggregations, scripted fields, and composite queries.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly positions the tool as an 'escape hatch' for cases where purpose-built alert tools are insufficient, and provides concrete restrictions (wazuh-* indices and read-only _search). This gives clear when-to-use guidance compared to sibling tools like wazuh_search_alerts or wazuh_alert_stats.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false. The description reinforces the read-only nature by saying 'List and filter' and adds context about server-side filtering, sorting, and paging. It does not contradict the annotations, though it does not discuss auth needs or rate limits, which are less critical given the annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is three concise sentences with no filler. The main purpose is front-loaded, followed by concrete use cases and a brief note on supported features. It is easy to parse and directly useful to an agent.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the rich parameter schema, clear annotations, and the presence of an output schema, the description provides sufficient context: it states what the tool does, gives example use cases, and notes filtering/sorting/paging support. No critical contextual information is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

All 11 parameters have individual schema descriptions, giving 100% schema description coverage. The description adds no additional parameter-level details beyond what the schema already provides, so the baseline score of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: 'List and filter agents enrolled with the Wazuh manager.' It includes concrete example questions ('which endpoints are disconnected', 'what agents are in group X', 'which agents run an outdated version') and distinguishes this list/filter tool from singular agent lookup or agent-related summary tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives explicit use cases with 'Use this to answer...' and mentions server-side filtering, sorting, and paging. It does not explicitly mention when not to use this tool or compare it to alternative tools, but the provided examples are strong enough for an agent to select it appropriately.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The annotations already declare readOnlyHint, idempotentHint, and destructiveHint, so the description does not need to repeat these. The description adds no extra behavioral detail (e.g., side effects, auth requirements), but it is fully consistent with the annotations. Given the lower bar when annotations are present, a score of 3 is appropriate.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two concise sentences with no redundant information. It states the main function and the primary use case, making it easy to parse and directly informative.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The output schema is present, so the description doesn't need to explain return values. The purpose and use case are clear, and the parameter descriptions (though partial) cover the key filters. The description provides sufficient context for an agent to decide when and how to invoke the tool, though it could mention pagination or filtering behavior, which is already implied by the parameters.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 50% (3 of 6 parameters have descriptions). The descriptions for search, filename, and decoder_names add meaningful context, but limit, offset, and status lack explicit descriptions. The covered parameters are the most domain-specific, but the overall coverage is only partial, so a mid-range score is justified.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb 'search' and clearly identifies the resource as 'decoders' that parse raw logs into fields. It also states the intended use case (when alert fields look wrong or absent), which makes the purpose unambiguous and distinguishes it from the listed sibling tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly states when to use the tool ('when an alert's fields look wrong or absent') and explains the benefit (see how a log source is being parsed). It does not explicitly mention when not to use it, but the context of sibling tools provides adequate differentiation, so a strong score is warranted.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description discloses the conditional output behavior and is consistent with the readOnly, idempotent, and non-destructive annotations. It does not mention pagination details, but the annotations already cover the main safety aspects.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise, using two sentences to convey the purpose and conditional behavior without extraneous detail.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers the core purpose and a key conditional behavior, and output schema is present. However, missing parameter semantics for pagination and lack of usage-selection guidance leave some context gaps.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Only the 'group' parameter is described; 'limit' and 'offset' are not mentioned. With schema coverage at 33%, the description adds some value for one parameter but leaves most parameter semantics undocumented.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool lists configured agent groups with member counts and checksums, and explicitly covers the conditional behavior of listing members when a group name is supplied. The verb and resource are specific.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

No explicit guidance is given for when to use this tool versus alternative sibling tools. The conditional note about passing a group name is useful but does not address tool selection or boundary conditions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already indicate read-only, idempotent, and non-destructive behavior. The description adds minimal extra context beyond implying a listing operation, so it does not significantly enhance transparency beyond the annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, concise sentence that conveys the essential information without verbosity. It is well-structured and easy to parse.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple listing tool, the description is complete enough. It covers the purpose, the resource, and the intended use case. Since an output schema is present, not detailing return values is acceptable.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The single parameter 'pattern' is fully described in the schema with a default value. The tool description does not add extra semantic detail about parameter behavior or constraints beyond what the schema already provides.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool lists wazuh-* indices with health, document counts, and sizes, plus cluster health. It uses a specific verb and resource, but does not explicitly differentiate from sibling tools like wazuh_indexer_query.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides clear guidance on when to use it: to confirm what data exists and how far back it goes before querying. Does not explicitly mention alternatives, but the intended use case is clear.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The annotations already declare readOnlyHint, idempotentHint, and destructiveHint, so the safety profile is covered. The description adds no additional behavioral details such as pagination behavior, permissions, or rate limits beyond the read-only search intent.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is three sentences and every sentence adds value: it defines the tool, lists concrete use cases, and gives examples. No fluff or redundant phrasing.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool has 12 parameters and a detailed schema, and the description covers primary use cases while parameter descriptions clarify filtering semantics. It is complete enough for effective use, though it could mention that wazuh_get_rule is the more targeted option for a single known rule.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Parameter descriptions are helpful and go beyond raw schema types, e.g., level supports '10' or '10-15', compliance_value explains omitting it matches any rule in the framework, and query provides a raw filter example. With 83% schema coverage, most parameters are well explained, though a couple like offset and limit rely on defaults rather than added semantics.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states 'Search the manager's ruleset' and gives concrete use cases like explaining why an alert fired, finding compliance-related rules, and auditing high-severity rules. It is distinguishable from siblings like wazuh_get_rule, though it does not explicitly contrast itself with single-rule retrieval.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides clear when-to-use guidance with three specific scenarios: alert explanation, compliance mapping, and high-severity auditing. It does not explicitly mention when not to use the tool or point to alternatives such as wazuh_get_rule for individual rule details.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already indicate readOnlyHint, idempotentHint, and non-destructive behavior. The description adds useful context by noting it reads the 'running' configuration and confirms 'actually enabled' settings, which implies no side effects or mutation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Two concise sentences with no redundant wording. The primary action and optional narrowing are stated first, followed by a practical use case. Every clause contributes meaning.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With an output schema present and both parameters fully documented, the description supplies sufficient context for invoking the tool correctly. It does not need to explain return values or further details.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% for both parameters. The description reinforces the 'section' parameter with concrete examples ('global', 'remote', 'syscheck', etc.) and clarifies that omission returns the whole configuration, adding marginal value beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

Description uses specific verb 'Read' and identifies the exact resource ('manager's running ossec.conf configuration'), with optional narrowing by section. It clearly distinguishes from sibling tools focused on search, agents, alerts, and other manager functions.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides a clear use case: 'Use this to confirm what is actually enabled — which modules, integrations, log sources or remote settings.' It does not explicitly name alternatives or exclusions, but the purpose is concrete enough for an agent to select it appropriately.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Description matches annotations: says 'Read' and 'filter', reinforcing read-only and idempotent behavior. No side effects implied, consistent with destructiveHint=false.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

One sentence with purpose, use cases, and example. Front-loaded with 'Read and filter ossec.log entries'. No fluff.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Includes purpose, use cases, and an example filter. The output schema is available and no nested objects. It doesn't mention pagination, but that's in schema. For a read-only log viewer, this is sufficient.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema provides descriptions for tag, level, search, summary (67% coverage). Limit and offset are self-explanatory. The description doesn't add extra parameter context, but the schema covers the main ones.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

States 'Read and filter ossec.log entries from the manager' – clear verb and resource. Also gives specific diagnostic use cases, distinguishing it from other Wazuh tools like manager stats or config.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly says 'Use this to diagnose ingestion problems, integration failures or daemon errors' and gives an example filter to level='error'. That is clear guidance. It doesn't mention alternatives, but the use cases are specific enough.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description accurately portrays the tool as a read-only statistics operation, matching the readOnlyHint and idempotentHint annotations. It adds useful context about what the stats are used for, and no side effects or destructive behavior are implied or omitted.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two concise sentences with no redundant wording. It front-loads the resource and capability, then provides a brief, useful use case in the second sentence.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema is provided, so the description is not required to detail return values. The description covers the essential selection criteria—what kind of statistics are available and what they are used for—making it complete for an agent to decide when and how to call it.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The single kind parameter has 100% schema coverage, and the description enriches each enum value with practical meaning: analysisd for capacity problems, remoted for agent-communication counters, and hourly/weekly for alert volume shape. This makes parameter selection unambiguous.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly identifies the resource as manager event-processing statistics and names the specific subcategories (analysisd, remoted, hourly/weekly). It also gives a concrete diagnostic purpose—spotting dropped events and queue saturation—which differentiates it from general health or alert-listing tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

It explicitly states when to use analysisd stats ('to spot dropped events and queue saturation') and gives hints for each kind parameter. It does not enumerate when other sibling tools should be used instead, but the use-case guidance is clear enough for correct selection.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The annotations already declare the operation as read-only, idempotent, and non-destructive, and the description is consistent with that behavior. No side effects are implied, so no additional disclosure is needed.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact and immediately informative, with no redundant wording or irrelevant detail. It front-loads the core purpose and then adds the primary usage scenario.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the modest parameter set and the presence of an output schema, the description provides sufficient context for correct invocation. It specifies the data source, supported resource types, and a concrete real-world trigger for using the tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema provides helpful descriptions for ids, search, and resource, including concrete examples of accepted ID formats. Limit and offset are not described but are standard pagination parameters whose meaning is evident from their names and defaults.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly identifies the tool as a lookup operation against the MITRE ATT&CK catalogue, listing the exact resource types it covers. It is easily distinguished from all sibling tools, none of which target MITRE data.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives an explicit use case: expanding a technique ID seen in an alert into its description, tactics, and mitigations. It does not name alternative tools, but the scenario is clear enough to guide selection.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description explicitly discloses the side effect (interrupts monitoring) and the write-permission requirement, matching the destructiveHint and non-readOnly annotations. This goes beyond the annotations to explain the operational impact.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two concise sentences, front-loads the action, and includes only essential context about side effects and permissions. No unnecessary wording.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple one-parameter, destructive-action tool, the description covers purpose, side effects, and prerequisites. The output schema is present, so no return-value explanation is needed.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema already documents the single required parameter agent_ids with a clear description and example. The tool description adds no additional parameter-level detail, so baseline coverage is sufficient.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

Clearly states the action ('Restart'), the target resource ('one or more agents'), and its effect (interrupting monitoring). This distinguishes it from sibling tools like search, list, and scan operations.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides useful context by noting the monitoring interruption and the WAZUH_ALLOW_WRITE=true requirement, so the agent understands when it is appropriate. It does not explicitly mention alternatives or when-not-to-use, but the purpose is clear enough.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The readOnlyHint and idempotentHint annotations already establish the non-destructive behavior; the description's 'Read' verb confirms this but adds no additional behavioral context such as side effects, rate limits, or data-source specifics.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences deliver the main purpose first and then a concise legacy/alternative note, with no redundant or filler content.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers what the tool returns, the legacy nature of the module, and the preferred alternative, while the output schema supplies return-shape details. This is sufficient context for an agent to select and invoke the tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The description does not elaborate on the limit, offset, search, or status parameters; it only reinforces that the data is per-agent, which the schema already states via agent_id. With only 60% schema description coverage, the description should have compensated by summarizing the filtering and pagination semantics.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'Read rootcheck findings for an agent.' It further clarifies the domain by listing rootkit signatures, hidden processes, and legacy policy-monitoring hits, and distinguishes itself from the sibling wazuh_sca_checks by calling SCA the modern equivalent.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly names wazuh_sca_checks as the modern equivalent and advises it is 'usually more useful,' giving an agent clear guidance to prefer SCA unless legacy rootcheck data is specifically needed.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare the tool as read-only, idempotent, and non-destructive. The description adds minimal behavioral context beyond that, primarily reinforcing the enumeration aspect, but does not introduce new side-effect information.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise, using two sentences to convey the purpose and use case without unnecessary detail or repetition.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple tool with two optional parameters, the description provides sufficient context, including a practical use case (filter value discovery). The output schema is separate and not required to be described here.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 50% with only the 'requirement' parameter described. The tool description adds some clarity by explaining the 'groups' default and framework controls, but leaves the 'limit' parameter ambiguous, not elaborating on its purpose or effect.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's function: enumerating rule groups or compliance framework values. It also distinguishes itself from siblings by mentioning its use in discovering filter values for wazuh_list_rules and wazuh_search_alerts.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly indicates when to use the tool: 'before calling wazuh_list_rules or wazuh_search_alerts' to discover valid filter values. This provides clear guidance on its practical application.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description discloses key behavioral aspects: it triggers a write operation, requires write permission, and places load on endpoints. The annotations already indicate readOnlyHint=false and idempotentHint=false, and the description aligns with those without contradiction.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact and front-loaded, using two sentences to convey the purpose, timing, prerequisite, and operational impact. There is no redundant or filler content.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple one-parameter action, the description provides the essential context: what triggers, when to use it, the required permission, and the side effect on endpoints. Output schema exists, so not describing return values is acceptable, though failure/response behavior could be slightly more explicit.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema already provides a clear description for the agent_ids parameter, including the format and an example. The tool description reinforces the scan context but does not add substantial meaning beyond the schema's own parameter documentation.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: to start a syscheck (FIM) scan immediately rather than waiting for the scheduled run. It also distinguishes this action from related read/search tools by identifying it as an on-demand scan operation.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly says when to use the tool ('instead of waiting for the schedule') and notes the prerequisite WAZUH_ALLOW_WRITE=true. It also warns about load on target endpoints, giving the agent enough context to decide whether this action is appropriate.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnly, idempotent, and non-destructive behavior. The description adds no additional behavioral details (e.g., pagination, rate limits), but also does not contradict the annotations. Given the annotations cover the key behavioral traits, a neutral score is appropriate.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences, direct, and free of redundant wording. It packs the core purpose and a key usage hint without unnecessary elaboration.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the rich schema (with per-parameter descriptions) and complete annotations, the description sufficiently explains what the tool does and how to use it for a common scenario. No critical missing information prevents correct invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema covers 71% of parameters with descriptions, and the tool description reinforces the meaning of 'result' and 'include_remediation' but does not add substantial new insight beyond what the schema already provides. The description does not clarify the undocumented 'limit' and 'offset' parameters.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a clear verb ('List'), specifies the resource ('individual configuration checks in one SCA policy'), and includes distinctive details like remediation text and the actionable filter. It clearly distinguishes this tool from wazuh_sca_policies which lists policies themselves.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides actionable guidance by suggesting filtering with result='failed' to get a hardening list. This is a concrete usage tip, though it does not explicitly contrast with sibling tools or state when not to use it.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false. The description reinforces this by describing a listing operation that returns counts and scores without side effects, adding useful output-behavior detail without contradicting the annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two tight sentences: the first states the action and output, the second gives the intended use case. Every word adds value and there is no redundancy or unnecessary detail.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the simple single-parameter input and the existence of an output schema, the description provides enough context: what the tool lists, the key output fields (pass/fail counts and hardening scores), why it is used, and how it relates to later drill-down. Nothing essential is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The only parameter, agent_id, is fully covered by the schema with a type, title, and description. The description adds a concrete example ('001') and ties the parameter to the agent whose policies will be listed, which is sufficient for a simple required identifier.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

Description uses the specific verb 'List' and identifies the exact resource: an agent's Security Configuration Assessment policies with pass/fail counts and hardening scores. It explicitly distinguishes this from deeper individual checks by noting it is the precursor to 'drilling into individual failed checks'.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Clearly states when to use this tool: to answer 'how well hardened is this host' and to do so 'before drilling into individual failed checks'. This gives explicit usage context and implies that deeper investigation belongs to a different tool.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already cover read-only, idempotent, and non-destructive behavior. The description adds useful behavioral context by noting that a compact projection is returned by default. It could add more about output size implications with full_documents, but the schema and annotations already provide substantial coverage.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences, front-loaded with purpose and followed by relevant examples. There is no filler, redundancy, or over-explanation, making it appropriately sized for the tool.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the rich schema covering all 16 parameters, an output schema, and the read-only annotations, the description is complete enough for an agent to select and invoke the tool correctly. It identifies the primary use, default projection, and typical query intents, with no required parameters or nested objects adding hidden complexity.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the baseline is 3. The tool description itself does not add parameter-specific semantic detail beyond the schema descriptions; the example questions give only indirect mapping to parameters like severity, agent_name, text, and mitre_id.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb, resource, and scope: 'Search security alerts in the Wazuh Indexer over a time window.' It provides concrete example questions that clarify intent. However, it does not explicitly differentiate from nearby sibling tools like alert_stats, alert_timeline, or indexer_query, so it falls just short of a top score.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

It clearly positions itself as the main tool for time-window alert searches and gives representative question types. It does not explicitly state when to prefer sibling tools for aggregations, timelines, or raw indexer queries, so the guidance is strong but not fully explicit about exclusions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already indicate read-only, idempotent, and non-destructive behavior. The description adds a useful compatibility note about working on both 4.8+ and earlier deployments, which is beyond the annotations. No contradictions found.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise, using two sentences plus examples. It is well-structured and every sentence adds value, covering functionality, filters, use cases, and compatibility.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a list-type tool, the description is complete: it covers what it does, filters, examples, and version compatibility. An output schema exists, so return value details are not needed. No missing context that would prevent correct usage.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema descriptions cover 5 of 7 parameters (71%), with limit and offset lacking descriptions. The tool description mentions filter fields but does not compensate for the missing limit/offset semantics. Parameters that do have descriptions are clear, but overall the parameter information is only partially complete.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states that the tool lists CVEs detected on endpoints, mentions the available filters (agent, severity, CVE ID, package), and provides example use cases. It is specific and distinguishes this from other tools like search or summary functions.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives example questions the tool answers, which is helpful, but it does not explicitly state when to use this tool instead of alternatives like wazuh_vulnerability_summary or wazuh_search_alerts. It also notes compatibility across versions, but lacks direct 'use this when' guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint true, idempotentHint true, and destructiveHint false, covering the main safety aspects. The description adds that it aggregates data, which is consistent with a read-only summary operation. No contradiction and the existing annotations lower the burden.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise—two sentences. The first sentence lists the aggregation outputs, the second gives the use case. No fluff or irrelevant details, and the key information is front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool is simple, parameters are fully described in the schema, annotations cover behavior, and an output schema exists. The description is sufficient for an agent to understand the tool's purpose and use it correctly without missing critical information.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema description coverage is 100% (top, agent_id, min_severity each have clear descriptions). Since the schema already fully explains the parameters, the description does not add extra parameter context, so the baseline of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool aggregates vulnerability exposure across the fleet, listing specific outputs (counts by severity, most affected agents, common CVEs, worst offending packages) and the intended use case (exposure reporting, deciding where to look in detail). This is specific and distinguishes it from sibling tools like wazuh_vulnerabilities.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides a clear use case ('Use this for exposure reporting and to decide where to look in detail'), which implies when to use it. It does not explicitly state when not to use it (e.g., for raw vulnerability lists), but the purpose is clear enough to guide the agent.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.