Similar Threats

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false, covering the safety profile well. The description adds valuable behavioral context by disclosing what the output contains (per-channel score breakdown, dominating signal, shared IOCs/CVEs, quality flags for stale or high-confidence-low-evidence links) and the existence of an output schema, making the result shape transparent.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

One dense, well-structured sentence that front-loads the purpose, then lists the evidence dimensions, and ends with the key usage pointer to explain_correlation. Zero waste, every clause earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool has 2 well-documented params (100% coverage), good annotations, and an output schema. The description complements these perfectly by clarifying the semantic richness of the output (evidence breakdown, quality flags) and providing the alternative-tool pointer. Nothing material is missing for a read-only, idempotent retrieval tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already fully documents both parameters (id as source threat ID, limit with default and max). The description adds the conceptual meaning of 'source threat ID' context (TL-2026-0042 example) but no additional semantics beyond schema. Baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb+resource ('Threats similar to a given threat') and clearly specifies what makes this distinct: it returns the EVIDENCE behind each link (score breakdown, dominant signal, shared techniques/IOCs/CVEs, quality flags). This distinguishes it well from sibling tools like explain_correlation (full decomposition of one pair) and get_correlation_path.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly states when to use this tool vs alternatives: it names explain_correlation for a full decomposition of one specific pair. The description positions this as the evidence-backed similarity listing, implying it is the right choice for broad similarity discovery with justification, while explain_correlation is for deep-dive pairs.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.