search_flows

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full behavioral burden, and it falls short: it never states the tool is a read-only query, says nothing about the 1440-minute default lookback window, result limits, or pagination, and gives no sense of cost or rate. The only behavioral content is the enumerated semantics of direction and action values.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Three short sentences with no filler, and the resource being searched is front-loaded before the field semantics. It is efficient, though the tight size leaves little room for the parameter coverage the rest of the definition needs.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return values need not be explained, but with 9 optional filters at 0% schema coverage and zero annotations, the description is not complete enough to invoke the tool confidently. The most likely invocation mistakes — how to scope by VM/VNet or IP, and how the default time window behaves — are unaddressed.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% across 9 parameters, and the description only documents two of them (direction as Inbound/Outbound, action as Allow/Deny). Filters such as src_ip, dst_ip, dst_port, vm_name, vnet_name, limit and since_minutes are left entirely for the agent to infer from parameter names.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource ('Search Azure VNet flow logs') and even frames the analytic question it answers ('whether traffic left or arrived at a NIC'). The named log source ('VNet flow logs') implicitly separates it from siblings like search_firewall_sessions and search_onprem_device_logs, though no sibling is named explicitly.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no guidance on when to choose this tool over search_firewall_sessions, trace_connection, or the other search_* siblings, and no exclusions or prerequisites are stated. The 'answers whether traffic left or arrived at a NIC' line hints at the use case but never routes the agent to an alternative.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.