Scored across 15 tools
Most tools have clearly distinct roles, but there is a cluster of YAML-consuming validation tools (parse_rule, validate_rules, lint_rules, fix_rules) whose boundaries require careful reading of descriptions to distinguish parse-only vs parse+compile vs spec-lint vs auto-fix. Similarly list_builtin_pipelines vs resolve_pipeline and convert_rules vs reverse_convert are related but description text keeps them separable.
All 15 tools follow a consistent snake_case verb_noun convention (author_ads, parse_rule, convert_rules, evaluate_events, fix_rules, lint_rules). Even the multi-word names (reverse_convert, resolve_pipeline, list_builtin_pipelines) keep the same structure, making the set highly predictable.
15 tools is well-scoped for a comprehensive Sigma rule analysis suite, covering parsing, validation, linting, fixing, conversion, evaluation, tuning, and introspection. Each tool maps to a distinct stage of the rule lifecycle and none appears redundant.
The surface covers a full rule lifecycle: author scaffold (author_ads), parse, validate, lint, fix, convert both directions, evaluate, tune, and field/pipeline/backend introspection. A minor gap is the absence of a general rule-creation or template-scaffolding tool beyond the ADS-specific and reverse-convert paths.