add_packet_capture

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description still discloses that this is a two-phase operation (create does not start capture), that FMG auto-assigns the capture_id, and the filter semantics when optional args are omitted. It does not mention permissions, ADOM locking, capture resource consumption, or expiry, which are the remaining behavioral gaps for a mutating tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with the one-line purpose, then Args/Returns/Example in a predictable layout. The doctest example is slightly long but earns its place by demonstrating the create-then-start chaining. Minor redundancy between Returns and the example's re-demonstration of the same keys.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For an 8-parameter creation tool with zero schema descriptions and no annotations, the definition covers purpose, all parameters, defaults, return shape, and the required follow-up call. An agent has everything needed to invoke it correctly and act on the result.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%, so the description carries the full burden and does: every one of the 8 parameters is explained, including the crucial format details the schema lacks ('port' as a string like "80" or "1-1024", 'protocol' as a string IP protocol number, 'host' matches any host if unset). Defaults and the FMG-default max_packet_count of 4000 are also given.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource ('Add a new FortiManager packet capture definition') and scopes it precisely: traffic 'originating or destined to the FortiManager itself,' which separates it from the device-sniffer siblings like create_device_sniffer. An agent can pick the right tool without opening a schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

It explicitly states the definition is created but not started and directs the agent to call start_packet_capture() with the returned capture_id, which is exactly the confusing part of this workflow. It doesn't explicitly name when to prefer create_device_sniffer or create_device_on_demand_sniffer, so the sibling routing is implied rather than spelled out.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.