sophos_get_forensic_log_status

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already indicate readOnlyHint=true, so the description's addition of 'status' is consistent but not expansive. It does not disclose behaviors like whether the status is pollable, what happens if the request ID is invalid, or typical status transitions. No contradiction with annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence that conveys the core purpose without extraneous information. It is perfectly concise and front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool is a simple status check with 3 parameters and no output schema, the description is minimally adequate. However, it lacks information on expected status values, potential errors, and typical usage patterns (e.g., calling repeatedly), which would improve completeness.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% with descriptions for each parameter. The description does not add extra meaning beyond the param names and schema descriptions. The reference to the initial request ID is already in the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool retrieves the status of a forensic log collection request. It specifies the prerequisite action (initiated with sophos_request_forensic_logs), distinguishing it from sibling status tools like sophos_get_memory_dump_status.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implicitly indicates the tool should be used after initiating a forensic log request, but it lacks explicit guidance on when not to use it or alternatives. No mention of polling frequency, error handling, or prerequisites beyond the initial request.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.