Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description must cover behavioral aspects. It states the tool adds an agent and returns an ID and key, but doesn't detail side effects, uniqueness constraints, or error conditions. This is adequate but leaves gaps.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise with a clear docstring format, front-loading the main action. It includes Args and Returns sections without unnecessary fluff.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given two parameters and no annotations, the description covers the core functionality, input guidance, and return value. It lacks error handling or prerequisites, but is sufficient for a simple creation tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%, so the description adds crucial meaning. It provides examples for both parameters ('webserver-01' for name, '10.0.0.10' for ip) and explains 'any' for dynamic IPs, which is essential for correct usage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states 'Add a new agent to the OSSEC manager' and explains the registration process. It distinguishes from sibling tools like list_agents and remove_agent by focusing on creation.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

It mentions that the agent will need to be authenticated and configured after addition, providing some context. However, it doesn't explicitly state when to use this tool versus alternatives, though the purpose is distinct.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries full burden and clearly discloses the destructive nature ('removes all stored file integrity data') and the consequence that the next scan creates a new baseline.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise (6 lines), front-loads the purpose, then explains consequences and parameter details with no superfluous content.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given one optional parameter, no annotations, and an output schema indicating JSON return, the description adequately covers behavior, parameters, and return value.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0% but the description adds meaning to the agent_id parameter, explaining its purpose and clarifying the default '000' corresponds to the manager.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb 'Clear' and resource 'syscheck database', and explains that it removes all stored file integrity data, distinguishing it from siblings like get_syscheck_results and run_syscheck_scan.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage for resetting the database and forcing a new baseline, but does not explicitly state when not to use it or compare with alternatives like run_syscheck_scan.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description must fully disclose behavioral traits. It only states it returns data, but fails to mention whether the operation is read-only, requires special permissions, or has any side effects or limitations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise at three sentences, front-loads the purpose, and includes necessary explanation of what active responses are. Every sentence adds value without redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool has no parameters and an output schema exists, the description adequately covers the purpose and return value. Minor omission: does not specify if scope is global or filtered, but overall sufficient for a simple read operation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has zero parameters, so the description has no burden to explain them. It adds value by describing the output format, which, while not parameter-related, is helpful context. Baseline 4 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the purpose: 'Get configured active response rules.' It explains what active responses are and specifies the return format as a JSON array of configurations. The verb is specific and the resource is distinct from sibling tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides no guidance on when to use this tool versus alternatives. It does not mention exclusions, prerequisites, or context for usage. The agent is left to infer usage from the name alone.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, and the description does not explicitly state that this is a read-only operation with no side effects. It lists returned fields but does not disclose behavioral traits like auth requirements or potential errors.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise, with clear sections for Args and Returns. It is front-loaded with the purpose. Slightly redundant with the existing output schema, but still efficient.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple tool with one parameter and an output schema, the description is complete. It explains the purpose, parameter, and return format. Missing details like error handling are acceptable given simplicity.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema coverage is 0%, but the description adds meaningful context for the agent_id parameter, including examples and the special case '000' for the manager, compensating for the missing schema documentation.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it retrieves detailed information about a specific OSSEC agent, using 'Get' as a verb and specifying the resource. It distinguishes from sibling tools like list_agents and get_alerts by focusing on a single agent's comprehensive details.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage when detailed info about one agent is needed, but does not explicitly state when to use or not use this tool compared to siblings. No exclusion criteria or alternatives are provided.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description provides no annotations and only states 'retrieve', implying a read-only operation. It does not disclose rate limits, authentication requirements, or other behavioral traits. Given no annotations, the description is adequate but not thorough.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise, front-loaded with the purpose, and uses clear structure (Args, Returns). Every sentence adds value, with no redundant information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given 6 parameters and an output schema, the description covers all inputs with detailed explanations, default values, and examples. It mentions the return format as a JSON array of alert objects, providing sufficient context for the agent.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The description adds significant meaning beyond the schema, explaining each parameter in detail including default values, valid ranges (e.g., severity levels 0-16), examples for time_range, and the return format. This fully compensates for the 0% schema description coverage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states 'Retrieve recent OSSEC security alerts with optional filtering', which includes a specific verb and resource. However, it does not differentiate from sibling tools like search_alerts, which may have overlapping functionality.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage through the parameter explanations, but it lacks explicit guidance on when to use this tool versus alternatives or when not to use it. It does not mention search_alerts or other filtering options.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description must cover behavioral traits. It states the tool returns a JSON summary, which implies a read-only operation, but it does not explicitly disclose side effects, permissions, or data volume. Lacks full transparency.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise and well-structured, with a first sentence stating the purpose, followed by details on counts, and a separate Args section. Every sentence adds value with no redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool has one parameter and an output schema, so completeness is modest. The description covers the main functionality and return format adequately, though it could mention that alerts are from OSSEC (assumed) or any limitations.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%, so the description adds critical meaning: it explains the time_range parameter with examples ('1h', '24h', '7d') and the default '24h'. This goes well beyond the schema's minimal definition.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states 'Get a summary of OSSEC alerts over a time period' and details that it provides counts grouped by severity level, rule group, and top triggered rules. This is specific and differentiates it from siblings like get_alerts and get_rules.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description includes the time_range parameter with examples and default, implying when to use it for summary statistics. It does not explicitly state when not to use it or mention alternatives, but the context of sibling tools and the description make usage clear.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description is the sole source for behavioral traits. It describes the tool as searching/retrieving, suggesting read-only behavior, but does not explicitly state non-destructiveness, permissions, or other safety aspects, which is insufficient for full transparency.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise and well-structured: a clear title line, a brief explanation of decoders, and a structured Args/Returns section. Every sentence is informative without redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's simplicity (two optional parameters, no required params) and the existence of an output schema (though not shown), the description covers purpose, parameters, and return format adequately. Minor omissions like pagination or error handling are acceptable for a search/retrieve tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 0% description coverage, but the description adds clear semantic meaning for both parameters: 'search' as free-text in decoder names and 'filename' as filter by file name with an example. This significantly compensates for the missing schema descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states 'Search and retrieve OSSEC log decoders,' using a specific verb and resource. It explains what decoders are used for, distinguishing them conceptually from related tools like get_rules, but does not explicitly contrast with sibling tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage when searching or retrieving decoders and provides parameter details. However, it lacks explicit when-not or alternative tool guidance, though the context of decoders vs rules is hinted at.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Describes read operation and return format, but with no annotations, it lacks disclosure on error behavior, authentication needs, or side effects. Adequate but not comprehensive.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Efficient, structured with Args/Returns, no redundant content. Every sentence adds value.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Covers core functionality and parameter; output schema exists for return type. Lacks mention of permissions but otherwise complete for a simple read tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Adds significant value beyond schema: lists common section values and explains default behavior (returns full config). Compensates for 0% schema description coverage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

Clearly states it reads the OSSEC configuration (ossec.conf) and returns parsed config. Distinguishes from sibling get_ossec_configuration_raw by implying raw vs parsed.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides context on optional section parameter and common values, but does not explicitly guide when to use this tool over siblings like get_ossec_configuration_raw or when to expect a section.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description bears full burden. It discloses that the output is plain text with XML formatting and comments preserved. However, it omits details such as file size implications, authentication requirements, or potential performance impact. The information is adequate but not comprehensive.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is extremely concise: two sentences and a returns line. It front-loads the essential purpose in the first sentence and adds minimal necessary detail, with no wasted words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's simplicity (zero parameters, clear return), the description is mostly complete. It explains the output format and preservation of comments. However, it misses an opportunity to contrast with the sibling 'get_ossec_configuration' which would provide full context for selection. The presence of an output schema (not shown) might cover return details, but its absence from provided information is a minor gap.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has no parameters, so schema coverage is 100%. Per guidelines, zero parameters baseline is 4. The description adds no additional parameter semantics because none are needed. The return value description is clear.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool retrieves the raw OSSEC configuration file content as plain text, preserving XML formatting and comments. This specific verb and resource, combined with 'raw' in the name, distinguishes it from the sibling 'get_ossec_configuration' which likely returns structured data.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is provided on when to use this tool versus any alternative, particularly the sibling 'get_ossec_configuration'. There is no mention of use cases, prerequisites, or conditions under which raw content is preferred over parsed output.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided, so description carries full burden. It discloses that it retrieves latest entries and explains parameters, but could add more context like being read-only with no side effects.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Description is well-structured with an Args section and Returns section, concise with no unnecessary words. Each sentence serves a purpose.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Low complexity tool with 2 optional parameters and output schema; description explains the JSON array output. Complete enough for effective use.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema has 0% coverage, but description fully explains both parameters: lines (number of lines, default 100) and category (optional filter with examples). Adds value beyond schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it retrieves OSSEC internal logs (ossec.log) for troubleshooting and monitoring, distinguishing it from sibling tools like get_alerts, search_alerts, and get_ossec_stats which handle alerts and statistics.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description mentions it is 'useful for troubleshooting and monitoring OSSEC's operation', giving context but lacking explicit guidance on when not to use it or alternatives for other log types.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries full burden. It indicates a read-only operation (Retrieves, Returns), which is non-destructive. However, it lacks details on potential side effects, rate limits, or other behavioral traits.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Description is concise with clear sections for purpose, args, and returns. No unnecessary words, and vital information is front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with one optional parameter and an output schema (exists but not detailed), the description covers the purpose, parameter format, and return type. It could list more exact response fields but given the output schema, this is acceptable.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The single parameter 'date' is fully described: optional, format YYYY-MM-DD, default current day. This adds significant meaning beyond the schema's minimal title and type.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it retrieves OSSEC processing statistics, listing specific metrics like events analyzed and alerts generated. It differentiates from siblings like get_alerts or get_ossec_logs by focus on aggregated stats, but does not explicitly compare.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this tool versus alternatives such as get_alerts or get_ossec_status. The description does not mention prerequisites or context for use.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description bears full responsibility. It discloses that the tool checks each daemon's running state and returns a JSON object with service status, running count, and overall state. It does not mention side effects, permissions, or limitations, but for a read-only status tool, the disclosure is adequate.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise: two sentences and a bulleted list. It front-loads the main purpose and efficiently lists the daemons covered, with no wasted words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given zero parameters and the note about output (even though the output schema exists), the description fully explains what the tool does and what it returns. No gaps remain for an agent to invoke it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

There are no parameters, so the schema coverage is 100%. The description does not need to add parameter semantics beyond what's already in the schema. Baseline 4 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The tool description begins with a clear verb+resource: 'Get the current status of all OSSEC services.' It then lists the specific daemons checked, making its purpose unambiguous and distinct from sibling tools like get_agent_info or get_alerts.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage for status checking but does not provide explicit guidance on when to use this tool over alternatives like get_ossec_logs or get_ossec_stats. No exclusions or prerequisites are mentioned.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided, so description must disclose behaviors. It states it is a retrieval operation returning JSON, but lacks details on permissions, rate limits, or side effects. The explanation of rootcheck adds some context.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Description is concise with a clear structure: purpose, background, parameter documentation, return type. Every sentence adds value with no redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple tool with one optional parameter and an output schema, the description covers purpose, parameter, and return type adequately. It could mention that results are from previous scans, but overall it is sufficient.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%, but description compensates by explaining the agent_id parameter (default '000' for manager), adding meaning beyond the raw schema which only provides type and default.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states 'Get rootcheck results for an agent' and explains what rootcheck does, distinguishing it from sibling tools like run_rootcheck_scan (which initiates a scan) and get_syscheck_results (file integrity).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this tool vs alternatives such as run_rootcheck_scan or get_syscheck_results. The description implies it returns results but does not specify prerequisites or context for use.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden. It discloses that the tool returns a JSON object with 'complete rule definition including all matching criteria, parent rules, frequency settings, and associated group.' It does not mention permissions, errors, or side effects, but for a read-only lookup, this is adequate.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise, front-loads the purpose, and uses a clear 'Args/Returns' structure without unnecessary words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers the essential behavior and return content. Given the tool's simplicity (one parameter) and the existence of an output schema, it is complete enough for an agent to invoke correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Although schema coverage is 0%, the description adds value by providing an example value for rule_id ('e.g., '5710') and clarifying its purpose. For a single, simple parameter, this is sufficient.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb 'Get' and the specific resource 'full details of a specific OSSEC rule by its ID'. This distinguishes it from sibling tools like 'get_rules' which likely lists rules, making the purpose unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

While the description implies when to use it (when you have a rule_id and need full details), it does not explicitly exclude alternatives or mention when not to use it. However, the context from sibling tool names helps infer its distinct use case.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations are absent, so the description carries full burden. It indicates read-only behavior ('search and retrieve') and describes the return format. However, it does not disclose potential pagination, performance considerations, or authorization needs. Acceptable but not comprehensive.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with a clear purpose sentence, followed by a brief context paragraph and a cleanly formatted parameter list. Every sentence adds value, no redundancy. Highly efficient.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given 6 parameters, no enums, and an output schema, the description covers parameter details and return format well. It could specify default behavior (e.g., all rules returned when no filters) and note if results are paginated. Mostly complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%, so the description compensates well by listing all 6 parameters with clear explanations and examples (e.g., '5710' for rule_id, 'sshd' for group). This adds significant meaning beyond the schema's bare titles and types.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states 'Search and retrieve OSSEC detection rules,' specifying the verb and resource. It distinguishes from sibling tools like 'get_rule_details' by focusing on search/retrieval of multiple rules, but could explicitly contrast with that tool for clarity.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this tool vs alternatives. Sibling tools like 'get_rule_details' exist but are not mentioned, leaving the agent to infer context. No when-not-to-use or prerequisite information.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided, so description carries full burden. It mentions the tool detects changes to file attributes but does not disclose behavioral traits such as result freshness, dependency on syscheck being enabled, or that empty results indicate no changes. This is adequate but could be more explicit.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with sections (overview, args, returns). Every sentence adds value without verbosity. It is concise yet informative.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Despite low complexity (2 parameters) and presence of an output schema, the description is fairly complete. It explains what the tool returns. However, it could mention error conditions or prerequisites (e.g., agent must have syscheck module enabled).

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, yet the description adds significant value by explaining both parameters: agent_id (with default '000' for manager) and file (optional path with example). This fully compensates for the lack of schema descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it retrieves File Integrity Monitoring results for an agent, using specific verbs and resource. It distinguishes from sibling tools like 'run_syscheck_scan' (starts a scan) and 'clear_syscheck_database' (clears results).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides basic usage context (query by agent_id, optional file filter, default manager agent). However, it does not explicitly state when to use this tool versus alternatives like 'get_rootcheck_results' or exclusion cases (e.g., agent not configured for syscheck).

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided, but description is straightforward about read-only retrieval. Lacks details on side effects, authentication requirements, or rate limits, which are not critical for a list operation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Concise and well-structured: title, brief description, parameter section, returns section. No unnecessary words, every sentence adds value.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple list tool with output schema, description provides essential info: what it lists, filter options, return format. Could mention if agents are sorted or paginated, but sufficient for intended use.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Description thoroughly documents the 'status' parameter with valid values and default behavior, compensating for 0% schema description coverage in the input schema. Adds meaning beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

Clearly states 'List all OSSEC agents', specifying verb and resource. Distinguishes from sibling 'get_agent_info' which retrieves details for a specific agent, as this returns a full list.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Implicitly shows when to use (to list agents with optional status filter) but does not explicitly state when to use alternatives or exclusion criteria.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided; description discloses return format but does not mention safety or side effects. For a read-only list, this is adequate but not explicit.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short sentences front-load the main action, with no fluff. Every sentence adds value.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Simple tool with no parameters and an output schema; description covers return type and purpose. Lacks potential use case but is sufficient.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

No parameters exist; schema coverage is 100% trivially. Baseline of 4 for zero-parameter tools applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

Description explicitly states 'List all OSSEC rule files' with a specific verb and resource. It distinguishes from siblings like 'get_rules' (returning rules) and 'get_rule_details' (specific rule details).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

No explicit when-to-use or alternatives guidance; usage is implied by the action, but no exclusions or context provided.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden. It explicitly states the permanent and irreversible nature of the operation, which is critical for an agent removal tool. It also mentions the return type (JSON object indicating success/failure). More details on prerequisites or error states would improve it.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is three sentences with no wasted words. It front-loads the action, then explains permanence, and ends with parameter and return details. Every sentence serves a purpose.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's simplicity (one parameter, output schema present), the description covers the key aspects: purpose, permanence, parameter format, and return type. It could be enhanced with error handling or prerequisite info, but it is sufficient for an agent to use.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The single parameter agent_id has zero schema description coverage, but the description adds an example ('e.g., ''001'') and clarifies it is the agent ID. This adds meaningful guidance beyond the schema's type-only definition.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states 'Remove an agent from the OSSEC manager' with a specific verb and resource. It distinguishes itself from sibling tools like add_agent, list_agents, and restart_agent by focusing on removal.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explains the permanent effect ('Permanently removes the agent registration. The agent will no longer be able to connect to the manager.'), providing clear context. However, it does not explicitly state when to use this tool versus alternatives, such as deactivating or suspending an agent.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries full burden. It discloses the restart action, configuration reload, and reconnection, but does not mention side effects like agent downtime or required permissions. Basic transparency is present.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise with no redundant text, and includes structured Args and Returns sections. Every sentence serves a purpose.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple tool with one parameter and a basic return, the description is mostly complete. However, it does not specify when a restart is valid (e.g., agent must be connected) or what failure reasons might be. The presence of an output schema is noted but not shown.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema has one required parameter (agent_id) with 0% coverage. The description adds meaning by specifying it's the agent ID and providing an example ('001'). This compensates for the schema's lack of descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool restarts a specific OSSEC agent, with a specific verb ('Restart') and resource ('OSSEC agent'). It distinguishes itself from sibling tools like restart_ossec and get_agent_info.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explains what the tool does but provides no explicit guidance on when to use it versus alternatives (e.g., restart_ossec, remove_agent). Usage is implied but not clarified.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Describes 'Stops and restarts all OSSEC daemons' but does not elaborate on side effects like potential downtime. With no annotations, slightly more detail would be beneficial.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Three efficient sentences with clear purpose, usage, and return value. No unnecessary words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Sufficient for a simple restart tool. Covers purpose, usage context, and output shape. Could mention that restart might be disruptive, but not critical.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

No parameters; schema coverage is 100%. Baseline score of 4 applies as description adds no param info, but none needed.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

Description clearly states 'Restart all OSSEC services' which is a specific verb+resource. It distinguishes from sibling restart_agent by targeting all services.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly states 'Use this after making configuration changes to apply them', providing clear context. Does not mention alternatives or when not to use, but sufficient for simple tool.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided, so description fully covers behavior. Warns that it performs real actions (destructive), and describes return as JSON indicating success or failure.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Well-structured with clear sections, but the warning could be integrated more concisely. Overall minimal fluff.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Covers purpose, parameters, return type, and usage caution. Lacks explicit differentiation from sibling tools, but the action-oriented nature makes it distinct.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, but description provides detailed explanations for all three parameters: agent_id (with example), command (with example list), arguments (with example). Adds substantial meaning beyond schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

Clearly states it executes an active response command on an agent, with specific verb and resource. Examples of commands and agent ID format reinforce purpose.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Includes a warning about real actions on the agent, advising caution. Lists common commands implying appropriate use. Does not explicitly mention alternatives among siblings.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It describes the tool as a test/analysis engine that does not modify state, which is consistent with its purpose. However, it does not disclose potential prerequisites (e.g., OSSEC must be running), authentication requirements, or any limitations. Given the test nature, the behavioral disclosure is adequate but not exhaustive.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise and well-structured: a short lead sentence, then a more detailed explanation, followed by formatted Args and Returns sections, plus example log lines. Every sentence adds value, and there is no wasted text. The structure is front-loaded with the essential purpose.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given that the tool has an output schema (so return format is largely covered) and is a straightforward diagnostic tool, the description is nearly complete. It explains inputs, outputs, and provides examples. It could be enhanced by mentioning that OSSEC must be active, but that is implicit. Overall, it provides sufficient context for an agent to use the tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The description includes an 'Args' section that explains both parameters: log_line (with example log entries) and verbose (meaning of True). This adds significant meaning beyond the basic schema, especially since schema coverage is 0%. The examples are helpful for users unfamiliar with OSSEC log formats.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: testing a log line against OSSEC rules and decoders to see decoding, rule matches, and alert level. It uses specific verbs ('Test', 'Runs') and resources ('log line against OSSEC rules and decoders'). Among sibling tools, it stands out as a debugging/testing tool, distinct from management tasks like get_rules or add_agent.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly says 'Extremely useful for debugging rules and decoders', providing clear context for when to use the tool. It does not explicitly state when not to use it or name alternatives, but the sibling tools do not directly compete (e.g., get_rules provides rule listings, not testing). The usage guidance is solid but lacks exclusionary criteria.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided. Description mentions initiating a scan and returning success status, but lacks details on whether the scan blocks, requires agent connectivity, or has side effects. Insufficient for full transparency.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Description is brief but includes an Args and Returns section. Could be more concise without losing clarity, but overall well-structured for a simple trigger tool.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Has output schema but not shown. Description explains return value. For a simple trigger, it's adequate but lacks error handling or conditions for successful trigger.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema provides minimal parameter info ('Agent Id' with default). Description adds meaning by explaining 'agent_id' as 'Agent ID to scan' and clarifying default '000' is for the manager.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

Clearly states the tool triggers a rootcheck scan on an agent, checking for rootkits, trojans, and security issues. Distinguishes from sibling 'run_syscheck_scan' by specifying the scan type.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Indicates the action (trigger scan) but does not specify when to use this tool versus alternatives like 'run_syscheck_scan'. No explicit context for appropriate use.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries full burden. It mentions triggering a scan and returning a JSON success indicator but does not disclose side effects like impact on running scans, performance, or required permissions, leaving behavioral gaps.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise with a front-loaded action statement, followed by an efficient Args section. Every sentence adds value with no redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The output schema exists and description mentions returning a JSON success indicator. However, it lacks details on error conditions, agent availability, or behavior when a scan is already running, making it partially complete for a simple tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0% (no descriptions in schema), but the description adds meaning by explaining the 'agent_id' parameter, including its default value '000' for the manager. This compensates for the schema's lack of detail.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states 'Trigger a File Integrity Monitoring scan on an agent' and 'Initiates a new syscheck scan', providing a specific verb and resource. It distinguishes from sibling tools like 'clear_syscheck_database' and 'get_syscheck_results' by focusing on triggering the scan.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description indicates use for initiating a syscheck scan but does not explicitly state when not to use or provide alternatives. Siblings like 'run_rootcheck_scan' exist, but no guidance on choosing between them is given.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden. It explains the tool searches across alert fields and returns a JSON array. It does not explicitly state it is read-only or mention rate limits, but it covers the core behavior comprehensively.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise, with a summary line followed by structured argument details. Every sentence adds value, avoiding unnecessary words while covering purpose, parameters, and return type.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool has 3 parameters and no nested objects, the description fully addresses input and output. It explains the query behavior, parameter details, and return format (JSON array). With an output schema available externally, no further details are needed.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must fully explain parameters. It does so by defining 'query' as a search string, 'limit' with a default, and 'time_range' with examples like '1h'. This adds complete meaning beyond the bare schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool searches OSSEC alerts with a free-text query across multiple fields. It specifies the resource ('OSSEC alerts') and the action ('search'), differentiating from siblings like 'get_alerts' which likely have different retrieval methods.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides clear context for when to use the tool (free-text search). While it does not explicitly exclude other use cases or mention sibling alternatives, the context of searching across fields is distinct enough to guide correct selection.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.