Campaign Intelligence

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false, so the agent knows this is a safe read operation. The description adds that it returns threats, actors, prevalence, and ATT&CK techniques, which is useful context. However, it doesn't describe authentication requirements, rate limits, or edge cases like unknown campaign names. With annotations that cover the safety profile, a 3 is appropriate - the description adds value but not rich behavioral depth.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is efficient - two sentences total. The first sentence is action-oriented with examples, and the second lists return contents. No wasted words or redundancy with the schema. Could arguably be more organized with explicit return-value formatting, but it's well-paced and scannable.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a single-parameter read tool with full schema coverage and clear annotations, this is fairly complete. The description covers what inputs to provide, what the tool returns, and the context (campaign/operation investigation). An output schema exists, so return-value details aren't the description's burden. Could improve by noting behavior for unknown campaign names, but overall adequate for the tool's complexity.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema covers 100% of parameters, so the schema alone documents the 'name' parameter. The description adds context by giving concrete examples of what campaign names look like ('Snowflake campaign', 'ClickFix'), which helps agents understand what value to pass. However, this is marginal value beyond the schema's 'Campaign / operation name' description.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states a specific verb+resource ('Pivot on a named campaign/operation by name') and lists what it returns (threats, actors, prevalence, ATT&CK techniques). It distinguishes from siblings through the 'campaign/operation' focus, though it doesn't explicitly name an alternative tool. The title 'Campaign Intelligence' reinforces but doesn't fully differentiate from similar threat/actor intelligence tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies when to use it - when you have a named campaign/operation to investigate. However, it doesn't explicitly explain when NOT to use it vs alternatives like get_actor_intelligence, get_threat_enrichment, or search_threats. Given the large sibling set with overlapping intelligence tools, this is a meaningful gap.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.