Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Since no annotations are provided, the description must carry the full burden. It discloses that the tool does not execute writes, which is the key behavioral trait. However, it omits details like authentication requirements, rate limits, or potential side effects of auditing.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, no wasted words, front-loaded with the core purpose and key behavioral caveat. Highly efficient.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the lack of output schema, the description does not explain what the tool returns (presumably the prepared command string). It also does not mention prerequisites like cscli installation. For a 4-parameter tool with no annotations, more context on output and prerequisites would be helpful.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 50% with descriptions for 'ip' and 'execute' only. The description adds context for the 'ip' parameter ('one IP') and for 'execute' (legacy no-op), but does not clarify 'reason' or 'duration' beyond what the schema provides. Overall marginal value.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states that the tool prepares and audits a potential cscli command to add a temporary allow decision for one IP, and explicitly notes that the MCP does not execute it. This distinguishes it from sibling tools like 'ban_ip' which likely involve execution.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies this tool is for dry-run preparation, not execution, but does not explicitly state when to use it versus alternatives or what prerequisites are needed. The contrast with ban_ip is indirect.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Without annotations, the description carries the full burden. It clearly states the tool does not execute the command, only prepares it for audit. This is a critical behavioral trait beyond what might be assumed.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Two concise sentences with no wasted words. The first sentence states purpose, the second clarifies behavior. Front-loaded and efficient.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers the main behavioral point (no execution) and purpose, but lacks details on return format, parameter explanations for reason and duration, and how the command is presented to the user.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 50%. The description adds context for the 'execute' parameter, clarifying it is a legacy no-op. However, 'reason' and 'duration' are not explained beyond defaults, so the description only partially compensates.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool prepares and audits a potential cscli command to add a CrowdSec ban for one IP, explicitly noting it does not execute. This distinguishes it from sibling tools like unban_ip and allow_ip.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description does not provide explicit guidance on when to use this tool versus alternatives such as unban_ip or allow_ip. It only implies it is for preparing a command for review.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided, so description carries full burden. Mentions read-only and no secrets, but does not disclose error behavior, rate limits, or what 'exposed capabilities' include. Lacks detail on side effects of include_sample_counts parameter.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Single sentence, 15 words, front-loaded with purpose. No fluff or repetition.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Adequate for a simple health check tool with one optional parameter and no annotations. However, lacks output schema or description of return format, which would help the agent interpret results.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema covers 100% of parameters. Description adds context about include_sample_counts potentially touching backends, which is useful behavioral detail beyond the schema's description.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

Description clearly states verb 'report' and resources 'health, configuration presence, and exposed capabilities'. Read-only nature distinguishes from sibling tools like ban_ip or recent_crowdsec_alerts.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Implies use for health checking but no explicit when-to-use or alternatives. Sibling tools suggest different purposes, but no guidance on when to choose this tool over others like security_summary.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral transparency. It correctly labels the tool as 'read-only,' which is crucial. However, it does not elaborate on the specific behavioral traits: it doesn't mention if any side effects occur (e.g., caching), what the 'findings' format looks like, or whether the operation requires special permissions beyond read access. It adds some value beyond the schema but could be more transparent given the tool's analytical nature.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, clear sentence that efficiently communicates the tool's core function and output type. There is no wasted verbiage, and the key action ('Compare') and result ('return read-only attention findings') are front-loaded. Every word earns its keep.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool has 5 parameters, no output schema, and no annotations, the description provides a solid high-level understanding. The lack of output schema means the agent cannot infer the return structure from structured data alone, but the description's 'attention findings' gives a useful conceptual summary. It is complete enough for a tool with well-named parameters and a straightforward analytical purpose, though additional examples of findings would strengthen usability.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 60%, meaning 3 of 5 parameters have descriptions. The tool description adds high-level context ('Compare...') that ties the parameters together into a coherent purpose, but it does not explain each parameter's role in the comparison. However, 'limit,' 'window,' 'repeat_threshold,' 'expiring_soon_hours,' and 'noisy_scenario_threshold' are well-named and their purposes are largely inferable from the parameter names and the high-level description. The description adds moderate value by hinting at the parameters' roles in the comparison logic.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('Compare') and clearly identifies the resources being compared ('active CrowdSec decisions' vs 'recent alerts'). The output is explicitly described as 'read-only attention findings,' which distinguishes its purpose from sibling tools that modify state (like 'ban_ip' or 'allow_ip') or retrieve raw data (like 'recent_crowdsec_decisions' or 'recent_crowdsec_alerts').

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implicitly suggests use when an agent needs to identify discrepancies between decisions and alerts. However, it does not explicitly state when NOT to use this tool (e.g., when you just need raw alerts or raw decisions) or mention alternative sibling tools for comparison. The context from sibling names helps, but the description itself lacks explicit usage guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided, so description carries full burden. Indicates read-only aggregation (summarize, views). Does not disclose potential side effects, pagination, or performance limits, but lack of destructive hints suggests safe operation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Single sentence, no unnecessary words, effectively communicates core functionality. Every element (filters, grouped counts, expiry views, representative rows) adds value.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

No output schema, so description should clarify return format. 'Representative rows' is vague. While 9 parameters and no output schema, the description partially compensates with feature enumeration, but lacks detail on what rows contain, error handling, or limits.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 67% (6 of 9 params documented). Description adds context about expiry views (related to long_lived_days and expiring_soon_hours) but does not fully compensate for missing parameter semantics on limit and other fields.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

Description clearly states it summarizes active CrowdSec decisions with specific features (filters, grouped counts, expiry views, representative rows). Distinguishes from siblings like recent_crowdsec_decisions (list) and inspect_ip (single IP).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Description implies use for aggregated overview but does not explicitly state when to use vs alternatives (e.g., for simple lists use recent_crowdsec_decisions). No exclusions or prerequisites mentioned.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, and the description fails to disclose read-only nature, authorization requirements, or potential side effects. It only states what the tool does without any behavioral context.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, front-loaded sentence with no extraneous words. It efficiently conveys the core purpose.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's simplicity (2 parameters, no output schema), the description is minimally adequate. However, the lack of behavioral context and no mention of return format leaves some gaps, though not critical for a simple inspection tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents both parameters. The description adds no additional parameter information beyond the schema, meeting the baseline for a tool with full schema coverage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly identifies the verb 'Inspect' and the resources 'CrowdSec decisions and CrowdSec alerts' for a specific IP. It distinguishes the tool from sibling tools like unban_ip or recent_crowdsec_alerts by focusing on inspection of both decisions and alerts for a single IP.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description does not provide any guidance on when to use this tool versus alternatives. For example, siblings like recent_crowdsec_alerts may serve a different purpose, but no comparison or context is given.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries full burden for behavioral disclosure. It adds an important behavioral trait—that LAPI alert lists require machine auth—but does not mention other traits such as whether the operation is read-only, potential rate limits, or error handling. The description is adequate but leaves gaps.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is extremely concise: two sentences with no wasted words. The first sentence front-loads the core purpose, and the second adds a key constraint. Every sentence earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's simplicity (one optional parameter, no output schema, no annotations), the description covers the core action and an important auth note. However, it does not explain the return format or what 'alert visibility status' entails, leaving some ambiguity. It is minimally viable but not fully complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% (the only parameter 'window' is fully described in the schema). The description adds no further meaning about this parameter, so the baseline score of 3 is appropriate. No additional semantic value beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool returns 'recent CrowdSec alerts and alert visibility status,' with a specific verb and resource. It distinguishes from the sibling tool 'recent_crowdsec_decisions' by focusing on alerts rather than decisions, making its purpose unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is provided on when to use this tool versus alternatives like 'crowdsec_health' or 'security_summary'. The only contextual note is about LAPI authentication, which is a requirement rather than a usage decision. There is no explicit when/when-not or comparison to siblings.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries full burden. It states the tool returns data (implying read-only), but does not disclose any behavioral traits such as data recency, pagination, latency, or authentication requirements. The word 'active' hints at state filtering but lacks elaboration.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single short sentence, making it concise. However, it is under-specified—it lacks important details like the meaning of 'active' or how the window parameter affects results. Conciseness is not a virtue if it sacrifices clarity.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no output schema and no annotations, the description is severely incomplete. It does not explain what the return data looks like, how 'active' is determined, or what happens when no window is provided. For a tool with only one optional parameter, this is a critical gap.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% with a clear description for the 'window' parameter ('Lookback window such as 15m, 6h, 24h, 7d.'). The description adds no additional semantic value beyond what the schema already provides, meeting the baseline expectation.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb 'Return' and the resource 'active CrowdSec decisions', making its core function understandable. However, it does not differentiate from sibling tools like 'decision_inventory' or 'recent_crowdsec_alerts', lacking specificity about what 'active' means or how it filters.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

No explicit guidance on when to use this tool over alternatives such as 'decision_inventory' or 'recent_crowdsec_alerts'. The description does not mention prerequisites, context, or use cases, leaving the agent without decision-making criteria.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the burden but provides no behavioral details. It does not indicate read-only status, side effects, or output format. This is insufficient for safe invocation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

One sentence is efficient, but it lacks structure and misses key details. It is not overly verbose, but could be more informative without adding length.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the complexity (1 optional parameter, no output schema, many siblings), the description is incomplete. It does not explain output, differentiation from siblings, or prerequisites.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% and the parameter description is clear. The tool description adds no extra meaning beyond the schema, but the schema itself is adequate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description states the tool summarizes CrowdSec decisions and alerts, distinguishing it from siblings like recent_crowdsec_alerts or recent_crowdsec_decisions. However, 'summarize' is vague and could mean an aggregated view vs a list.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this tool over siblings. It does not mention alternatives or scenarios where a summary is preferred over detailed lists.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided, so description carries full burden. It only states it suggests a proposal, but does not disclose side effects, read-only nature, or output behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

One concise sentence with no redundancy, but slightly underspecified for completeness.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no output schema and only one optional parameter, the description lacks information about what the output looks like or when this tool is most useful.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% for the single parameter 'window', and description adds no additional meaning beyond the schema's definition.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool suggests a CrowdSec scenario proposal from repeated patterns, distinguishing it from sibling tools like recent_crowdsec_alerts or security_summary.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this tool versus alternatives. The description does not mention prerequisites or context for usage.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Without annotations, the description fails to disclose behavioral aspects like default window, maximum number of IPs returned, or any side effects. It only says 'recent' without specifying a default lookback or how results are ordered.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, concise sentence that immediately conveys the tool's purpose. No extraneous words or repetition.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the lack of output schema and annotations, the description is too brief. It does not specify return format, default windows, or what 'top' means (count or limit), leaving agents with incomplete information.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% with a clear parameter description. The tool description adds no additional semantic value beyond what the schema already provides for the 'window' parameter, so baseline score of 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb 'Return' and the resource 'top source IPs by recent CrowdSec alert volume', making the tool's purpose unambiguous. It distinguishes itself from sibling tools like 'recent_crowdsec_alerts' and 'inspect_ip' by focusing on aggregated top offenders.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is provided on when to use this tool versus alternatives such as 'inspect_ip' or 'recent_crowdsec_alerts'. There are no usage scenarios, prerequisites, or exclusions mentioned.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Clearly states the MCP does not execute the command, only prepares it. Explains the 'execute' parameter is a legacy no-op. With no annotations, this is good disclosure of non-destructive behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences that immediately convey purpose and key constraint. Every word earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Lacks explanation of what 'audit' means, the output format, or prerequisites like CrowdSec installation. Given no output schema and only moderate schema coverage, description could be more complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 67% (ip and execute described; reason missing). Description adds no value for reason and only restates execute's no-op nature. No compensation for the undocumented reason parameter.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

States it prepares an audited cscli command to delete a CrowdSec decision for an IP. Clear action and resource, but does not explicitly differentiate from sibling tools like ban_ip or allow_ip.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this tool versus alternatives like ban_ip or allow_ip. Only implies usage when user wants to unban but not execute directly.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.