get_flow_matrix

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure. It clearly explains the aggregation logic (group by src/dst, sort by total bytes descending) and identifies the specific fields used, giving the agent a good sense of what happens during execution, though it omits edge-case behavior like handling missing files or empty results.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with clear sections for Args and Returns, and the prose is efficient. The first paragraph and second paragraph share some redundancy (both mention aggregation), but the extra detail about field extraction and sorting is valuable and not excessive.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers the tool's purpose, parameters, and return value, making it functionally complete for invocation. It lacks explicit usage guidelines versus sibling tools, which is a minor gap, but given the output schema exists and the description provides all necessary details, it is overall complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema has 0% description coverage, but the description compensates fully by providing a dedicated Args section that explains each parameter with concrete details (e.g., file_path is a PCAP, display_filter example 'not arp', top_n default 20). This exceeds the schema's sparse structure and gives the agent complete parameter understanding.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it builds a host-pair communication matrix showing traffic volume, with specific details about extracting ip.src, ip.dst, and frame.len fields. This distinguishes it from sibling tools like get_packet_statistics or aggregate_flows by focusing on host-pair aggregation and byte totals.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage for analyzing host-pair traffic volume but does not explicitly state when to use this tool over alternatives. No exclusions or comparative guidance are provided, leaving the agent to infer based on the tool's name and description.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.