check_failed_logins

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the burden of explaining behavior. The verb 'Inspect' conveys a non-destructive read operation, and the description states what will be returned: a JSON string with failed logins and top offending IPs. It does not discuss authentication or data source, but nothing suggests hidden side effects or destructive behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact and well-structured with clear Args and Returns sections. Every sentence adds useful information, and the main purpose is front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a single-parameter read-only tool with an output schema present, the description is sufficiently complete. It covers what the tool does, what the parameter means, and what kind of result to expect.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The only parameter, limit, is fully explained in the description: it is the number of recent failed attempts to inspect, with a default of 20 and a max of 100. This adds essential information not present in the schema, especially since schema description coverage is 0%.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('Inspect'), a clear resource ('recent failed SSH login attempts'), and a goal ('detect brute-force attackers'). This separates it from sibling tools like get_fail2ban_status and audit_ssh_config.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies when to use the tool: when checking recent failed SSH login attempts to detect brute-force activity. It gives clear context but does not explicitly mention alternatives or when-not-to-use conditions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.