get_dns_queries

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure. It adds a useful behavioral trait — 'captures queries even for very brief connections' — which indicates the tool's comprehensiveness. However, it does not disclose return format, pagination, rate limits, or authentication requirements. This is a moderate level of transparency, but not exhaustive.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is exceptionally concise: two sentences. The first sentence states the core purpose, and the second adds a comparative advantage and filtering capabilities. There is no redundant or extraneous information. Every word earns its place, making it highly efficient for an agent to parse.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's moderate complexity (4 optional params, no output schema), the description is reasonably complete. It explains what the tool does, when it is more useful than alternatives, and what parameters it supports. The main gap is the lack of an explicit response shape, but since there is no output schema, the description could have mentioned the output format. Still, it provides enough context for an agent to select and invoke the tool effectively.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 100% parameter description coverage, so the schema already documents all four parameters (mac, count, domain, hoursBack). The description adds some contextual meaning by mentioning 'filtering by device MAC, domain, and time range,' but this largely mirrors the schema. It does not introduce major new semantics beyond the schema, so the baseline of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's function: 'Get DNS query logs showing every domain a device attempted to resolve.' It uses a specific verb ('Get') and resource ('DNS query logs'), and distinguishes itself from flow data by noting it 'captures queries even for very brief connections.' This makes it easy to differentiate from siblings like get_device_flows or search_flows.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides a clear usage context by explicitly comparing to 'flow data' and explaining why this tool is more complete for capturing DNS queries, even for brief connections. However, it does not name specific sibling tools or state when not to use this tool, so it falls short of full explicit when/when-not guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.