sophos_get_xdr_query_results

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries full burden. It mentions pagination and that results are for completed runs, but does not disclose what happens if the query is still running, if the run_id is invalid, or error handling. More behavioral context is needed, such as idempotency or rate limits.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences: first states purpose, second explains pagination. It is concise and front-loaded without unnecessary words. Every sentence earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with 5 parameters and pagination, the description covers purpose and pagination adequately. It lacks explicit mention that the query must be completed before calling, but overall it is sufficiently complete given the schema coverage and lack of output schema.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so baseline is 3. The description adds value by explaining the pagination mechanism (page_from_key) and that page_total includes total counts, but does not add significant meaning beyond the parameter descriptions. Score at baseline.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states 'Retrieve the results of a completed XDR query run,' which is a specific verb-resource combination. Among siblings like sophos_get_xdr_query and sophos_get_xdr_query_status, this tool uniquely retrieves results, so it is well-differentiated.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explains key-based pagination and how to use page_from_key from the previous response to fetch the next page, providing clear usage guidance. It does not explicitly state when not to use it or compare with alternatives, but the pagination instruction is valuable.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.