log_aggregate

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false, so the bar is low for additional transparency. The description still adds value by explicitly stating 'Read-only' and detailing the return structure (bins and spikes with zscore), as well as the aggregation types. It stops short of describing bin alignment or time range inclusivity, but given the annotation coverage, this is thorough.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description uses clear section labels (WHEN, INPUT, RETURNS) and front-loads the purpose. Every sentence contributes essential information: purpose, usage, parameter semantics, and output shape. There is no redundancy or filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with 7 parameters, no output schema, and no schema descriptions, this description covers all aspects: what it does, when to use it, how parameters map to log_search, the aggregation options, and the full return format. It fully equips an agent to select and invoke the tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description carries the burden. It explains aggregation values (COUNT, UCOUNT, etc.) and defaults (bin_width_ms=60000), and clarifies 'text/last/begin_ms/end_ms' share log_search semantics. While it relies on the user knowing log_search for some params, that reference is a reasonable way to reuse existing knowledge and adds meaning beyond bare schema names.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with '[READ] Aggregate matching events into a time series and detect spikes,' which uses a specific verb ('Aggregate') and resource ('matching events') and clearly distinguishes from sibling tools like log_search (raw events) and log_fields. It immediately conveys the tool's unique role.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The 'WHEN' section explicitly states the use case: 'to find when/whether log volume burst without pulling raw events.' It also provides guidance on follow-up with log_search for the spike window, and clarifies that the input semantics match log_search. This is exemplary usage direction.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.