threatfoxSearch

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden of disclosing behavior. It states accepted input types but fails to explain what the search does beyond acceptance—e.g., exact vs. partial matching, whether multiple results are returned, pagination, rate limits, or if any authentication is needed. The absence of output schema further increases the need for behavior details, which are not provided.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two short sentences that completely avoid redundancy. It front-loads the core action and then lists accepted inputs efficiently, with no filler or irrelevant details.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple one-parameter tool, the description conveys the essential purpose and input types, but given the lack of output schema and annotations, it omits critical behavioral information such as return format, result count, or whether the search is exact. This makes it minimally adequate but incomplete for an agent to fully anticipate the tool's behavior.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% and the description's parameter explanation ('IP, domain, hash (MD5/SHA256), or URL') exactly mirrors the schema's own description of searchTerm. Since the schema fully documents the parameter, the description adds no additional semantic value, deserving the baseline score of 3.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's function: searching ThreatFox IOCs by a term. It specifies the accepted input types (IP, domain, hash, URL), making the purpose distinct from general search tools. While it doesn't explicitly differentiate from sibling threatfox tools, the verb 'Search' and resource 'ThreatFox IOCs' make the primary action unmistakable.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage when you have a specific IOC term to search, but provides no guidance on when to prefer this over sibling tools like threatfoxGetIocs or threatfoxTag. There are no exclusions, prerequisites, or alternative suggestions, leaving the agent to infer the appropriate context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.