Get Detections

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, idempotentHint=true, destructiveHint=false, so the safety profile is established. The description adds valuable behavioral context: pagination mechanics (has_more, next_cursor reusable as offset/cursor) and the specific precedence rule (cursor ignored when offset given). This enriches the annotation-based safety signals with concrete runtime behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Three efficient sentences with zero wasted words. Front-loads the core purpose, then filters, then pagination mechanics. Every clause adds information that isn't elsewhere, and the structure logically groups listing behavior, filtering, and pagination in order of importance.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool has an output schema, which relieves the description of explaining return values. With 5 parameters, no required fields, pagination mechanics explained, and read-only idempotent semantics assumed from annotations, this is reasonably complete. Minor gap: doesn't name sibling alternatives (search_detections) for when broader search is needed, but the complexity is low enough that the description suffices.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so all five parameters are documented in the schema. The description adds the relationship between cursor and offset (cursor decoded to offset, ignored when offset given), which is genuinely helpful beyond the schema. However, the individual parameter descriptions in the schema are already thorough; the description's contribution is mainly the cursor/offset interaction nuance, warranting baseline 3 rather than higher.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

Description states a specific verb+resource ('List detection logic') and enumerates the content formats (Splunk SPL, Microsoft KQL, Sigma). It distinguishes from siblings like search_detections (which implies a search action) and get_detection_detail (singular detail) by specifying this is a listing operation with filters. Clear differentiation from sibling tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description clarifies pagination behavior and mentions optional filtering by threat_id or type, giving clear usage context. However, it doesn't explicitly contrast with search_detections or get_detection_detail, nor state when to prefer this over those alternatives. The pagination guidance is strong but sibling differentiation is implied rather than explicit.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.