Parse Pcap

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already cover the safety profile (readOnly, idempotent, non-destructive), and the description adds substantial behavior beyond them: the optional scapy dependency with install command, the 64KB token-budget truncation rule, the 'truncated:' sentinel flow format with total/shown counts, partial-frame handling, and protocol auto-detection when the parameter is omitted. No contradiction with annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The core pipeline is front-loaded, then the description flows logically through output structure, parameter default, dependency, and truncation behavior. Every sentence carries distinct information; the length is justified by the tool's genuine complexity around truncation, sentinel flows, and dependencies.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Covers the essential operational context: dependency requirements, truncation budget, sentinel flow shape, auto-detection default, and efficiency characteristics. Since an output schema exists, return-value structure is already handled elsewhere. Minor gaps: no explicit error conditions for invalid paths or malformed pcaps, and the path parameter format is not stated.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate. It explains protocol's semantics well — auto-detect by the protocol with the most complete frames when omitted, and use it as a filter to retrieve remaining frames — but path is only implied by the phrase 'Wireshark 导出 pcap' rather than explicitly documented as the pcap file path to read.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource — parse Wireshark-exported pcap — and details a distinct three-stage pipeline: aggregate by TCP flow, split by protocol, then parse_auto per frame. The batch/flow-aggregation scope clearly differentiates it from single-frame siblings like parse_frame, and the explicit efficiency comparison against per-frame frame_hex reinforces that distinction.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides clear context: suited for Wireshark-exported pcap files and large batch scenarios where it is 'much more efficient' than parsing frame by frame, plus a concrete follow-up strategy ('use protocol= to filter or split the pcap to re-parse') when frames are missing. It does not explicitly name alternative sibling tools or state when not to use it, but the implied usage scope is largely sufficient.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.