observable_indicators

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnly/idempotent/non-destructive/closed-world, so safety is covered. The description adds real value beyond that: it warns that text fields are third-party CTI content to be treated as untrusted data rather than instructions, a prompt-injection guardrail the annotations cannot express. It also discloses which fields come back, though it says nothing about ordering or how the default limit interacts with large result sets.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The functional statement is front-loaded in one dense sentence, and the security caveat is separated into its own short paragraph. Both parts earn their place, though the caveat is generic boilerplate that could be a single clause.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return values need not be described, and the parameters are fully documented in the schema. What remains is a clear statement of what is returned and a trust warning — enough for an agent to call this correctly, with only pagination/ordering behavior left implicit.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%: 'id' is documented as an OpenCTI UUID or STIX id and 'first' carries its default and OPENCTI_MAX_FIRST cap. The description adds only the framing that the id identifies an observable, so the schema does the heavy lifting and baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('List the indicators') plus the relationship scope ('linked to an observable') and enumerates the fields returned (pattern, score, validity, kill chain). That clearly separates it from lookup_observable/get_observable, though no sibling is named explicitly.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The relationship scoping ('indicators linked to an observable') implies when to reach for this tool rather than get_observable, but there is no explicit when-to-use, no exclusion, and no named alternative among the siblings.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.