sophos_get_mdr_threat_feed

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description must disclose behavioral traits. It reveals that the tool returns a transactionId for asynchronous polling, indicating it is not immediate. However, it does not mention authentication needs, error conditions, or explicitly state that it is read-only (implied by 'get'). The async detail adds value but further transparency on side effects or rate limits is missing.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two clear sentences: the first states the action, the second explains the return value and next step. No unnecessary words. Every sentence adds value, achieving maximum conciseness.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no output schema and no annotations, the description is moderately complete. It explains the async workflow and links to the polling tool, but lacks details on error scenarios, permissions, or the structure of the final result. For a simple 2-parameter read operation, it covers the main flow but has gaps.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Input schema has 100% description coverage for both parameters (tenant_id and firewall_id). The description adds no additional semantics beyond the schema's 'Tenant UUID' and 'Firewall UUID', so the baseline score of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action: retrieving MDR threat-feed configuration for a specific firewall. The verb 'Retrieve' and the specific resource 'MDR threat-feed configuration' are precise. While it does not explicitly differentiate from sibling get tools, the name itself provides sufficient distinction among the many sophos_get_* tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides guidance on post-call action (poll sophos_get_firewall_transaction for the result), which helps the agent understand the async workflow. However, it does not mention when to use this tool versus alternatives like sophos_search_mdr_threat_feed_indicators or any prerequisite conditions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.