IOC Blast Radius

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnly and idempotent, so the safety profile is covered. The description adds critical behavior beyond that: case-insensitive matching, CVE union semantics from two sources, authoritative CVE-to-threat mapping, and the caveat that edge_scores is a sampled projection and never the denominator for counts.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Three sentences, each dense with necessary information and no filler. The core purpose is front-loaded, and the behavioral caveats are organized logically.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description is complete for a moderately complex but bounded tool: it explains inputs, depth semantics, matching behavior, edge probabilities, CVE-specific union logic, and tool alternatives. An output schema exists, so detailed return values do not need to be restated.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents both parameters. However, the description adds meaningful elaboration: it defines depth traversal rings concretely (1=threats, 2=+techniques, 3=+actors & sibling IOCs) and clarifies the meaning of coverage and edge_scores in the output, going beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific action ('Map the blast radius'), a precise resource ('one indicator'), and enumerates the output dimensions (threats, MITRE techniques, actors, sibling IOCs). It also differentiates itself from the closest sibling by explicitly saying get_ioc_intelligence is for a richer multi-source dossier.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly says 'Use this to scope impact of a single IOC' and names the alternative for a richer dossier on one indicator (get_ioc_intelligence). This gives the agent clear selection criteria and an exclusion.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.