Retrieve NetFlow/sFlow records to analyze network traffic. Filter by source or destination IP and device ID to isolate specific conversations.
Get network flow data (NetFlow/sFlow)
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Max results | |
| dest_ip | No | Filter by destination IP | |
| device_id | No | Device ID | |
| source_ip | No | Filter by source IP |
Changes observed during successful MCP inspections.
v4.2.0Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already establish read-only, idempotent, non-destructive behavior, so the description does not need to restate those. It adds minor useful context by specifying NetFlow/sFlow protocols, but it does not disclose behaviors like result ordering, time-window assumptions, or whether filters are combinable.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, focused sentence with no redundant wording or filler. It puts the core action and resource first, making it quick for an agent to parse.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple read-only getter with fully documented parameters and strong annotations, the description is adequate. However, it lacks any mention of return value shape or pagination behavior, and with no output schema present, this leaves some ambiguity about what the agent should expect.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so all four parameters are already documented in the input schema. The description adds no extra meaning about parameter semantics, resulting in the baseline score without further compensation.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description identifies a clear verb ('Get') and resource ('network flow data'), with protocol details (NetFlow/sFlow) adding precision. It does not explicitly contrast itself with sibling data-retrieval tools like get_top_talkers or get_interface_metrics, so it falls short of full differentiation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no guidance about when to use this tool versus alternatives such as get_top_talkers, get_interface_metrics, or audit_network_monitoring_coverage. The description only states what the tool retrieves, with no contextual conditions, exclusions, or mention of prerequisites.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.