sophos_list_policy_endpoints

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already provide safety context (readOnlyHint, destructiveHint). The description adds minimal behavioral context beyond the core function, such as policy-level scoping. It does not discuss pagination behavior, error cases, or response structure, but given the strong annotation coverage, the description's limited contributions are acceptable.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence that gets straight to the point with no redundancy or unnecessary details. It is well-suited for a minimally complex read operation.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

While the tool is straightforward, the description omits information about output format, pagination implications, and potential limitations. Given the lack of an output schema, additional context would be helpful to set agent expectations about the return structure.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema covers all parameters with descriptions (100% coverage). The description does not add additional meaning beyond what the schema provides. Since the schema is sufficient, a baseline score of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action ('list'), the resource ('endpoints or endpoint groups'), and the scope ('governed by a specific policy'). This distinguishes it from sibling tools like sophos_list_endpoints (which lists all endpoints) and sophos_get_endpoint_group (which retrieves a specific group). However, ambiguity remains regarding whether both endpoints and groups are returned together or separately.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides no explicit guidance on when to use this tool versus alternatives. It does not mention prerequisites, exclusions, or scenarios where other tools like sophos_list_endpoints or sophos_get_endpoint_group would be more appropriate. This leaves the agent without clear decision-making context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.