Scored across 15 tools
Most tools have clearly distinct purposes (e.g., convert_rules vs reverse_convert, evaluate_events vs test_exemplars, list_* vs resolve_pipeline). However, the parse/validate/lint/fix cluster (parse_rule, validate_rules, lint_rules, fix_rules) has overlapping boundaries that could lead an agent to pick the wrong one despite detailed descriptions.
All 15 tools use snake_case with a predictable verb_noun pattern (evaluate_events, parse_rule, lint_rules, list_backends, etc.). The only mild deviation is reverse_convert, which is still snake_case and understandable, so consistency is excellent.
15 tools is at the upper end of the ideal 3-15 range but each tool covers a distinct facet of the Sigma rule lifecycle (authoring, parsing, validation, conversion, evaluation, pipelines). The count is well-scoped for the broad purpose of a Sigma rule toolkit.
The surface covers the core Sigma lifecycle very well: authoring (reverse_convert, tune_rules, author_ads), parsing (parse_rule, parse_condition), validation (validate_rules, lint_rules), fixing (fix_rules), conversion (convert_rules, list_backends), evaluation (evaluate_events), testing (test_exemplars), and pipeline/field introspection. Minor gaps exist, such as no rule search/index or diffing tool, but agents can work around these with file paths.