ad_get_admin_count_users

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden, and it discloses almost nothing beyond the [READ] tag. It doesn't say that adminCount reflects historical (stale) SDProp protection rather than current privilege, whether results include disabled accounts, or whether the scan is expensive over a large directory.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

A single front-loaded sentence with category and read-only tags, no filler. It is efficient, though it is efficient at saying too little rather than at conveying a complete instruction.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return-shape explanation is not required, but the description still omits the one thing an agent needs: what 'relevant' adminCount means and how this differs from the other privileged-account audit tools. For a security/audit tool with no annotations, that gap is material.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Only one optional parameter (correlation_id) with 0% schema description coverage, and the description says nothing about it. However, a correlation ID is largely self-explanatory plumbing, and there are no domain/scope/filter parameters to mis-set, so the practical cost of the omission is limited.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a specific resource (accounts with adminCount attribute) and tags it as read-only security/audit, so the general intent is graspable. But 'relevante' (relevant) is vague — it never states the actual filter (e.g., adminCount=1 / non-inherited ACL / SDProp-protected objects), which is exactly what distinguishes it from siblings like ad_get_privileged_users or ad_get_domain_admins.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

No when-to-use guidance, no prerequisites, and no mention of the several closely related audit tools (ad_get_privileged_users, ad_get_domain_admins, ad_get_delegated_permissions) an agent would weigh against it. The [Security & Audit] tag is the only category signal, which is a hint rather than guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.