C2 Intelligence

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false, so the safety profile is covered. The description adds useful behavioral context beyond that: it positions the data as 'live', names the default view as 'beacons', and clarifies that the tool returns raw records rather than transformed blocklist output.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact: one sentence states the main purpose, one enumerates the views with useful semantics, and one names the alternative tool. Every section earns its place and the most important information is front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With 100% schema coverage, an output schema, and robust annotations, the description only needed to add purpose, view semantics, and sibling differentiation — all of which it provides. The missing details such as exact default limits and the offset caveat are present in the input schema, so nothing essential is absent.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline starts at 3. The description goes beyond the schema by clarifying what each view means — for example, 'watermarks' is a Cobalt Strike watermark index and 'correlations' contains cross-C2 correlations — which makes the enum values more interpretable for an agent.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly identifies the tool as querying the live C2 intelligence center and enumerates seven concrete views with short parenthetical definitions. It also distinguishes itself from the sibling generate_c2_blocklist by contrasting raw records with firewall-ready output, so an agent can pick the right tool without opening schemas.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly explains the available data views and names the alternative generate_c2_blocklist for firewall-ready output. This gives the agent concrete when-to-use and when-not-to-use guidance rather than leaving that to inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.