Get Malware Intelligence

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and idempotentHint=true, so the description's safety profile is clear. Description adds behavioral context about what intelligence is returned (canonical family, prevalence, threats, actors, techniques), but does not mention any edge cases or limits. This goes beyond annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, zero waste. Front-loaded with the action and key context. Every sentence earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's simplicity (one parameter, read-only query), the description fully covers purpose, alternatives, prerequisite, and return contents. No output schema, but description provides a comprehensive list of what is returned.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Input schema covers 100% of parameters with a concise description. Description reiterates the parameter as 'malware FAMILY by name' with examples (LockBit, Vidar, Emotet), reinforcing the intended usage but adding little beyond the schema. Baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

Description clearly states it pivots on a malware family by name, lists return contents (canonical family, type, prevalence, threats, actors, ATT&CK techniques), and distinguishes from sibling get_tool_intelligence. Verb 'pivot' and resource 'malware FAMILY' are specific.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly guides when to use this tool (for malware families) versus get_tool_intelligence (for offensive tools), and advises using resolve_entity first if name is uncertain. This provides clear decision context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.