Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It clearly indicates a read-only operation ('Retrieve') and explains the optional relationship inclusion. It does not mention destructive actions, authentication needs, or rate limits, but the behavior is transparent enough for a simple retrieval.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences, with the primary action front-loaded. Every sentence adds value: the first defines the core function, the second clarifies the optional relationships feature. No unnecessary words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

While the description explains the tool's purpose and relationship expansion, it does not describe the response format or structure. Given no output schema, this leaves a gap in understanding what the agent can expect to receive.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, providing a baseline of 3. The description adds meaning by explaining that the 'id' parameter is a collection identifier from relationship lookups and lists the relationship options with context, going beyond the enum.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description states 'Retrieve a VirusTotal collection by ID' with a specific verb and resource. It further explains that collections represent threat actors, malware families, etc., distinguishing it from sibling tools that retrieve individual entities like files or domains.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description mentions optionally including relationships to fetch member IOCs, giving context on when to expand results. However, it does not explicitly state when not to use this tool or compare to alternatives beyond the implicit differentiation from sibling tools.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided, so description carries full burden. Mentions pagination but does not disclose error handling, idempotency, rate limits, or what happens if domain is not found. Limited transparency.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, front-loaded with purpose, no wasted words. Efficient and to the point.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Adequate for a tool with pagination and enum parameters, but missing output schema and details about response structure. Does not cover authentication or error cases.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Description adds pagination context to limit/cursor, but domain and relationship parameters are already well-described in schema. Schema coverage is 50%, so description compensates slightly but not fully.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

Clearly states verb 'Query', resource 'domain relationship', and includes pagination support. Lists examples of relationship types, distinguishing it from sibling tools like get_domain_report.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Implies usage for specific relationship types ('detailed investigation of specific relationship types') but does not explicitly state when not to use or provide alternatives. Context from sibling tools helps but description lacks direct guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description must handle behavioral disclosure. It only states the tool returns data, but doesn't mention side effects, permissions, rate limits, or whether the operation is read-only. For a comprehensive report tool, more transparency (e.g., potential size) is expected.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences long, front-loaded with the core purpose, and includes the key optionality detail without unnecessary words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with no output schema, the description adequately notes both basic analysis and relationship data are returned. It could mention potential response size constraints, but given the optional relationships parameter, it is fairly complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% with both parameters described. The description adds that `relationships` is optional, which is a small addition. No further depth beyond schema details, so baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states 'Get a comprehensive domain analysis report' and lists specific data types (DNS records, WHOIS, relationships). It distinguishes from siblings like `get_domain_relationship` by implying an aggregated report rather than a single relationship.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage for obtaining a broad domain overview but does not explicitly contrast with `get_domain_relationship` or other siblings. No exclusions or when-not-to-use guidance provided.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Without annotations, the description carries full burden. It discloses that results are merged across multiple sandboxes and lists returned data types. It does not mention permissions or rate limits, but for a read-only summary tool, the disclosure is sufficient.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Single sentence with no wasted words. It front-loads the main purpose and efficiently lists what the summary includes.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a single-parameter tool with no output schema, the description thoroughly explains return values including processes, files, registry, network activity, MITRE ATT&CK techniques, IDS alerts, and signature matches. It also clarifies the merged nature of the data.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% with a clear description of the hash parameter. The description adds context that the hash can be MD5/SHA-1/SHA-256, which is consistent with the schema pattern. This meets the baseline for high-coverage schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool gets a consolidated sandbox behaviour summary for a file, listing specific data categories like processes, files, registry, etc. It distinguishes from sibling tools like get_file_report by emphasizing the merged, comprehensive view.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly states it is 'far more useful than iterating individual behaviour reports,' providing clear guidance on when to use this tool over siblings that return individual reports.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description discloses pagination support, a behavioral trait. With no annotations, this is helpful but minimal. It does not mention error handling, authentication, or read-only nature (though implied by 'Query').

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences: one functional, one illustrative. No fluff or repetition. Efficiently packed with key info.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the schema and sibling tools, the description covers purpose, relationship variety, and pagination. No output schema is provided, but the description is sufficient for an agent to understand the tool's role relative to others. Minor gap: no example of expected return structure.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 50% (hash and relationship have descriptions). The description adds context for relationship types ('behaviors, network connections, dropped files...') and mentions pagination, but does not explain limit/cursor semantics beyond the schema defaults. Adequate but not compensating fully for uncovered parameters.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool queries a specific relationship type for a file with pagination support. The verb 'Query' and resource 'relationship type for a file' are specific. Sibling tools like 'get_file_report' and 'get_domain_relationship' differentiate it clearly.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description mentions it is useful for detailed investigation of specific relationship types, which implies usage context. However, it does not explicitly contrast with sibling tools or state when not to use it, leaving the agent to infer from sibling names.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden. It discloses a non-obvious behavior: automatically fetching relationship data in addition to the basic analysis. It also specifies what content is included. However, it does not mention potential latency, failure modes, or whether any auth/permissions are required, but for a read-only 'get' tool, the disclosure of auto-fetching is valuable and goes beyond a minimal description.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences, front-loaded with purpose, and every phrase earns its place. It succinctly lists report contents and the auto-fetch behavior without redundancy or fluff.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool has one parameter and no output schema, the description provides a reasonable overview of the return content ('detection results, file properties, and key relationships') and the fact that it returns both basic analysis and relationship data. It does not specify the exact output format, but that is not required when an output schema is absent. The description is sufficiently complete for a simple get-by-hash tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% and the only parameter, 'hash', is already described in the schema as 'MD5, SHA-1 or SHA-256 hash of the file'. The description repeats this information ('using its hash (MD5/SHA-1/SHA-256)') without adding new meaning like format details, examples, or validation rules. Baseline 3 applies since the schema does the heavy lifting.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('Get') with a clear resource ('comprehensive file analysis report') and identifies the input (hash). It lists what the report includes (detection results, file properties, relationships), and distinguishes itself from sibling tools like get_url_report or get_file_relationship by noting it returns both basic analysis and automatically fetched relationship data.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives clear context: use when you need a comprehensive file report by hash. It does not explicitly name alternatives or exclusions, but the scope is evident from the resource type (file) and the inclusion of relationships, which separates it from get_file_relationship. No explicit when-not-to-use is stated, so it falls short of a 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided. Mentions pagination support but does not disclose read-only nature, authentication needs, rate limits, or response format. For a query tool, the behavioral burden is partially unmet.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences efficiently convey purpose and context. No redundancy. Could be slightly more structured but is acceptable.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

No output schema exists; description does not explain response structure, error handling, or prerequisites (e.g., valid IP). Lacks details on pagination output (e.g., cursor usage). Incomplete for a tool with 4 parameters.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 50%. Description adds 'pagination support' which loosely covers cursor and limit, but does not elaborate on parameter formats, defaults, or enum meanings beyond what the schema provides. Fails to fully compensate for low coverage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

Clearly states the verb (query), resource (IP address relationship), and specificity (specific relationship type with pagination). Distinguishes from siblings like get_domain_relationship by focusing on IP. Lists relationship types implicitly through the input schema enum.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides context 'useful for detailed investigation of specific relationship types' but does not explicitly compare to alternatives like get_ip_report or get_domain_relationship. Lacks when-not-to-use guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It discloses that relationship data is 'automatically fetched', which is a behavioral trait beyond a simple read, but it does not mention potential side effects, rate limits, or whether any network calls are made. The description does not explicitly state it is read-only, though the verb 'get' implies it. Some transparency is present, but significant gaps remain.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences, front-loaded with the action and resource, and every phrase adds value. It efficiently lists what the report includes and highlights the dual return of basic and relationship data without fluff.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the complexity of an IP report tool with no output schema, the description provides a good inventory of what is returned (geolocation, reputation, relationships) and mentions both basic analysis and auto-fetched relationships. It lacks specifics about the return structure or any limitations, but for a single-parameter tool, this is sufficient to guide an agent. Slight deduction for not mentioning potential response size or filtering options.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% for the only parameter 'ip', which already includes a clear description ('IP address to analyze'). The tool description adds no additional meaning to the parameter beyond restating it in context. Baseline of 3 is appropriate since the schema does the heavy lifting.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

Description clearly states 'Get a comprehensive IP address analysis report' with a specific verb and resource. It lists concrete contents (geolocation, reputation, key relationships) and distinguishes itself from sibling tools by emphasizing the comprehensive nature and inclusion of both basic analysis and relationship data.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies this is the go-to tool for full IP analysis, but it does not explicitly state when to use it versus alternatives like get_ip_relationship. Since the sibling tool exists for relationships, mentioning that this tool includes relationships could be confusing without explicit usage boundaries. No when-not-to-use guidance is provided.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, and the description adds context about pagination and relationship types but does not disclose error behavior, rate limits, or authentication requirements. The description partially compensates for missing annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, each serving a clear purpose: stating the core action and providing usage context. No wasted words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Covers purpose, usage scenario, and pagination support. Lacks details on return format and error handling, but given no output schema, it is reasonably complete for a query tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema covers 50% of parameters with descriptions; the tool description adds context for pagination (limit and cursor) and lists examples of relationship types, enhancing understanding beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool queries a specific relationship type for a URL with pagination support, distinguishing it from get_url_report which only provides a summary.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly mentions it is useful when the summary in get_url_report is truncated, providing clear guidance on when to use this tool over a sibling. However, it does not explicitly state when not to use it.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries full burden. It discloses the caching behavior (returns cached report if available) and the fallback to submission with waiting. This is important for an agent to understand latency expectations. No information about authentication or rate limits is given, but the key behavioral trait of caching is covered.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences: the first states the comprehensive output, the second explains the caching and submission behavior. Every word adds value, no redundancy, and the structure is front-loaded with the most important information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the lack of an output schema, the description provides a detailed list of what the report contains (security scan, communicating files, contacted domains/IPs, downloaded files, redirects, threat actors). It also explains the caching mechanism. This is sufficient for an agent to understand the tool's capabilities and behavior.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% for the single parameter 'url', which is described as 'The URL to analyze' with a URI format. The description does not add additional constraints or details beyond the schema, so it meets the baseline but does not exceed it.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool retrieves a comprehensive URL analysis report including security scan results and key relationships. It identifies the resource (URL) and the action (get report), but does not explicitly differentiate from siblings like get_url_relationship, which also provides URL-related data. However, the specific relationship types listed are unique to this tool among the siblings.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explains that the tool returns cached results when available, otherwise submits and waits. This gives implicit guidance on when to expect immediate results vs. delays. However, it does not compare to alternative siblings or specify when to use this tool over others, such as get_url_relationship.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided, so description carries full burden. Discloses query acceptance and pagination, but lacks details on response format, error handling, or rate limits. Adds some context beyond schema.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences with no wasted words. Front-loaded with purpose in first sentence, second sentence adds valuable details. Ideal conciseness.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

No output schema, but description does not hint at return structure (e.g., list of results, count). For a search tool, this is a gap. Adequate for usage guidance but incomplete for full context.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 33% (only 'query' described briefly). Description adds significant value: explains VTI-style search with examples, mentions cursor for pagination, and reinforces limit behavior. Significantly enriches parameter understanding.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it searches the VirusTotal corpus for multiple entity types (files, URLs, domains, IPs, comments) and distinct query styles. It distinguishes from sibling tools, which are all retrieval of specific reports.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides explicit guidance on query types (IOCs, free text, VTI modifiers) and pagination via cursor. Does not explicitly state when not to use or compare to alternatives, but context implies search vs. direct lookups.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.