Threat Enrichment

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false, so the safety profile is covered. The description adds beyond-annotation context by specifying exactly what enrichment categories are included and framing it as 'complements get_threat', giving the agent a sense of scope. It doesn't mention response size or performance, but the existing output schema likely mitigates that need.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences accomplish a great deal: the first enumerates the full enrichment scope with parallel structure, the second names the sibling tool and clarifies the differentiator. Zero filler words, no repetition of annotation content, information density is high.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool is simple (1 param, all required, fully documented schema coverage) and has a rich output schema plus strong annotations. The description fully specifies what enrichment data will be returned, makes the complementary relationship to get_threat explicit, and covers when and why to use it. For a tool of this complexity, nothing meaningful is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the single id parameter is fully documented with a concrete example format ('TL-2026-0042'). The description reinforces the 'by ID' scoping ('one threat by ID'), which clarifies the parameter's role. While the description doesn't add new parameter syntax details, it confirms the ID is the sole input for this enrichment view, which is meaningful given sibling tools with multiple parameters.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb+resource combination ('Reference-grounded enrichment for one threat by ID') with a detailed enumeration of the enriched content (malware families, tools, targeted sectors/regions, OS, campaigns, ATLAS techniques, mitigations). It also distinguishes from the sibling get_threat by explicitly naming what that tool covers ('overview/MITRE/IOCs/detections') and what this one provides ('what malware/tools were used and who was targeted').

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly names the complementary sibling tool get_threat and differentiates the two views, instructing the agent to call this one for the malware/tools/targeting perspective. This is clear when-to-use guidance with an explicit alternative named.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.