Wireshark MCP

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already state readOnlyHint=true and openWorldHint=false, covering the safety profile. The description adds no behavioral context beyond that—no note on cost, memory, result size, or interaction with display_filter.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Two compact sentences with the capability list front-loaded and no filler. The bracketed tag is slightly awkward but the text is efficient.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 12-parameter aggregation tool with no output schema and no schema descriptions, this is far too thin. An agent cannot determine how the many field/metric parameters combine or what the result shape will be.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0% across 12 parameters, so the description must carry the burden. It only clarifies that field lists are comma-separated, leaving group_by, distinct, top_k, sort_by/sort_numeric, time_bucket_seconds and the *_fields params essentially unexplained.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description identifies what the tool produces (counts, groups, distinct values, numeric metrics, top-k, time buckets), which conveys an aggregation/statistics purpose. However, the verb/resource is only implied via the bracketed label '[Primary statistics]' and no capabilities are framed to distinguish it from siblings like wireshark_stats_endpoints or wireshark_stats_conversations.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no explicit when-to-use guidance and no mention of alternatives among the many stats/aggregate siblings. The agent is left to infer that this is the generic rollup tool versus the more specialized stats_* tools.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and openWorldHint=false, so the safety profile is covered. The description adds useful behavior beyond that – bounded row output, preset fields, and fixed tables for RTP/SMB – but says nothing about pagination, what 'bounded' means relative to the limit param, or the return shape.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Two compact sentences with zero filler, and the core action plus output note are front-loaded. Slightly terse given the undocumented parameters, but nothing is wasted.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a read-only analysis tool with no output schema, the description is minimally adequate: it conveys the operation, bounded output, and the special protocol handling. However, with 0% parameter coverage and no return-value detail, an agent lacks enough to call it confidently across the 20-value protocol enum.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must carry the load and largely does not. It mentions 'one protocol' and the RTP/SMB table quirk, but never explains the limit parameter's role or bounds, nor adds meaning to the pcap_file input, leaving all three parameters effectively undocumented.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource ('Analyze one protocol') and adds scope detail ('with preset fields and filter'), plus a special-case note for RTP/SMB fixed tables. It is clear what the tool does, though it never names a sibling (e.g. wireshark_extract_fields or wireshark_stats_protocol_hierarchy) that an agent might otherwise confuse it with.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no explicit when-to-use or when-not-to-use guidance, and no alternative tool is named despite many overlapping siblings (extract_fields, search_packets, stats_protocol_hierarchy). Usage is only weakly implied by 'Analyze one protocol'.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description lists the health indicators analyzed, adding context beyond the readOnlyHint annotation. However, it does not disclose the format of results (e.g., textual summary, structured report) or any limitations (e.g., only works on TCP packets). Since annotations already indicate read-only, the description's additional detail is adequate but not comprehensive.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is extremely concise with a single sentence. It front-loads the category '[TCP]' and immediately states the action and indicators. Every word earns its place, with no wasted text. This is ideal for quick scanning by an AI agent.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with one parameter and no output schema, the description lacks completeness. It does not specify the output format (e.g., report, summary, list), which is critical for an agent to determine if the tool's result meets its goal. Additionally, it does not mention prerequisites (e.g., valid TCP traffic in pcap) or limitations. Given the moderate complexity of network analysis, this omission reduces completeness.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 0% schema description coverage, the description must implicitly convey parameter meaning. The single required parameter 'pcap_file' is implied by the tool's purpose (analyzing TCP health from a packet capture), but the description does not explicitly state its role or expected format (e.g., file path). The context is sufficient for an agent, but explicit parameter description would be helpful.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool analyzes TCP connection health and lists specific indicators (retransmissions, dup ACKs, zero window, resets). The verb 'Analyze' and resource 'TCP connection health' are specific. However, it could be more explicit about the output format (e.g., summary table or list of issues), which would further clarify the tool's exact purpose. It distinguishes from generic protocol analysis tools like wireshark_analyze_protocol.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides no guidance on when to use this tool versus alternatives (e.g., wireshark_analyze_protocol, wireshark_stats_expert_info). It does not mention that it is focused on TCP health only, nor does it specify prerequisites like TCP traffic being present. An agent could misinterpret when to invoke this tool over other analysis tools.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already indicate destructiveHint=true and openWorldHint=true. The description adds minimal extra behavioral context beyond capture_filter and ring_buffer syntax, not covering potential file overwrites or permission needs.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is very short with no superfluous content. Two sentences front-load the purpose and parameter hints efficiently.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, 6 parameters, and 0% schema coverage, the description lacks essential details about required parameters (interface, output_file) and behavior (e.g., file overwrite, capture termination). Incomplete for safe invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%; the description provides syntax examples for capture_filter and ring_buffer, adding value for 2 of 6 parameters. However, interface, output_file, packet_count, and duration_seconds remain undescribed.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states 'Capture live network traffic', which is a specific verb+resource. It distinguishes from sibling tools that analyze or process existing captures.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

No explicit guidance on when to use this tool vs alternatives. The name and context imply it's for starting a new capture, but no exclusion criteria or alternative referrals are given.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already provide readOnlyHint=true, and the description does not contradict that. It adds minimal behavioral context beyond the example, such as how decode rules affect interpretation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is extremely concise but lacks structure and completeness. It front-loads the category but the single sentence does not efficiently convey all necessary information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with 5 parameters, no output schema, and many siblings, the description is far too brief. It fails to explain prerequisites, return values, or typical use cases.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 0% schema description coverage, the description should compensate but only gives a hint about decode_rules format. Other parameters (limit, fields, pcap_file, display_filter) are left unexplained.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it is for dissection and decode-as for non-standard ports with an example. However, it does not explicitly differentiate from similar dissection tools among siblings.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this tool versus alternatives like wireshark_analyze_protocol or wireshark_decrypt_tls. The description lacks any context for selection.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and openWorldHint=false; description adds context about using SSLKEYLOGFILE and showing HTTP data, which aligns with readOnlyHint and provides moderate extra behavioral insight.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Single, front-loaded sentence with '[Decrypt]' tag. No wasted words, efficient communication of core functionality.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a complex decryption tool, the description is incomplete. It lacks details on return values (e.g., decrypted packets, HTTP objects), how to interpret results, and the role of display_filter. No output schema to compensate.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, and the description fails to explain the parameters (pcap_file, keylog_file, display_filter) beyond their names. The mention of 'using SSLKEYLOGFILE' hints at keylog_file's role but is insufficient.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action (Decrypt), target (TLS traffic), method (using SSLKEYLOGFILE), and output (show HTTP data). It distinguishes from siblings like wireshark_decrypt_wpa and wireshark_verify_ssl_decryption.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this tool versus alternatives. Does not mention prerequisites (e.g., needing a keylog file) or when not to use (e.g., if no keylog available). Siblings exist but no differentiation provided.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description does not disclose behavioral traits beyond the annotation readOnlyHint: true. It fails to mention what happens with incorrect passphrases, whether the output is decrypted packets, or that the tool reads a pcap file. The description adds no behavioral context beyond the annotation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, well-structured sentence that is front-loaded with a tag. Every word contributes meaning, with no redundancy or waste.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with 4 parameters, no output schema, and numerous siblings, the description is too minimal. It omits vital context: the tool operates on a pcap file, requires a WPA handshake, and its output format. The agent cannot fully understand the tool's purpose or use it effectively.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate. It clarifies the purpose of the passphrase and SSID parameters, but completely ignores pcap_file (required) and display_filter. This is insufficient to guide parameter usage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states that the tool decrypts WPA/WPA2 traffic using a passphrase and optional SSID, which distinguishes it from sibling tools like wireshark_decrypt_tls. The verb 'Decrypt' and resource 'WPA/WPA2 traffic' are specific and unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is provided on when to use this tool versus alternatives such as wireshark_decrypt_tls or wireshark_verify_ssl_decryption. There is no mention of prerequisites, limitations, or context for selection.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, so the read-only nature is clear. The description adds behavioral details (specific spoofing types) but does not disclose additional traits like output format or performance implications.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is extremely concise (one line) and front-loaded with a category tag [ARP]. Every word adds value, though it could be slightly more structured.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's simplicity (one input, no output schema, clear annotations), the description sufficiently covers its purpose and behavior. However, it lacks explanation of output or side effects, but these are minimal given read-only nature.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema has 0% description coverage for the pcap_file parameter with only one parameter. The description does not explain the parameter at all, failing to compensate for the low schema coverage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it detects ARP spoofing and lists specific types (duplicate IP-MAC, gratuitous floods, reply storms), distinguishing it from other detection siblings like port scan or exfiltration.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

While the description implies use for ARP spoofing detection, it does not explicitly state when to use or not use this tool versus alternatives. The sibling context provides differentiation but the description lacks direct guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already indicate read-only behavior. The description adds value by explaining the detection method (analyzing timing intervals and jitter). However, it does not disclose the return format or detailed algorithm thresholds.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single concise sentence with a relevant '[Anomaly]' prefix. It is efficient but could be slightly expanded to include more context without losing conciseness.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no output schema and 3 parameters with no descriptions, the description is insufficient. It does not explain what the tool returns or provide enough detail for an agent to confidently use it without additional context.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The description mentions 'jitter' and 'timing intervals' but does not explicitly link to the parameters max_jitter and min_connections. With 0% schema description coverage, the description provides minimal additional meaning for the parameters.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: detecting periodic communication patterns (C2 beacons) by analyzing timing intervals and jitter. The verb 'detect' and the specific anomaly type distinguish it from other detection tools in the sibling list.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this tool versus alternatives like wireshark_detect_exfiltration or wireshark_detect_dns_tunnel. The description lacks any when-to-use or when-not-to-use information.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already establish readOnlyHint=true and openWorldHint=false, so the safety profile is covered. The description adds value by disclosing the detection heuristics it applies, but says nothing about evidence quality (heuristic vs. confirmed), false-positive behavior, or the shape of results. With annotations carrying the safety burden, this is an adequate-but-thin 3.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

A single front-loaded sentence with the [Security] tag first and the detection criteria in parentheses; every clause earns its place. It is terse to the point of under-specification, but there is no wasted text.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a single-parameter detection tool with annotations covering the read-only profile, the definition is minimally complete. However, with no output schema, nothing tells the agent what the detection returns (candidate list, counts, per-domain detail), leaving a real gap for interpreting results.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

There is one parameter (pcap_file) and schema description coverage is 0%, so the description carries the full explanatory burden and does not mention the parameter at all. An agent gets no clarification on accepted formats, path expectations, or whether the file must be pre-opened with wireshark_open_file.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description gives a specific verb (Detect) and resource (DNS tunneling candidates) and enumerates the heuristics used (long query names, TXT abuse, high subdomain fanout), which makes the intent unambiguous. It does not, however, differentiate itself from nearby siblings such as wireshark_extract_dns_queries or wireshark_detect_exfiltration, so the agent must infer the boundary.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no statement of when to reach for this tool versus alternatives like detect_exfiltration, detect_beaconing, or extract_dns_queries, and no prerequisites (e.g. that a pcap_file is required) are surfaced in prose. The name and heuristics imply a use case but the description offers no explicit routing guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and openWorldHint=false, so the agent knows this is a safe local read. The description adds nothing further: no thresholding logic, no note on false positives, no indication of whether it analyzes the whole file or a window, and no mention of what constitutes a 'pattern' hit.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

A single front-loaded sentence with the [Security] category tag, the verb, the resource, and parenthetical examples. Nothing is wasted, though the examples are the only thing that keeps it from being a bare name restatement.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a one-parameter read-only detector with no output schema, the definition is minimally viable but leaves the return shape unexplained — the agent cannot tell if results are a boolean, a list of anomalies, or volume statistics. It should say more about what a detection report contains.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The single parameter pcap_file has 0% schema description coverage and the description does not compensate — it never explains what the file argument should be (capture path, format, size limits). Only one parameter exists, but its semantics are left entirely implicit.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb+resource (detect DoS/DDoS traffic volume patterns) and enumerates the concrete attack signatures it targets (SYN flood, ICMP/UDP flood, DNS amplification). That clearly separates it from sibling detectors like detect_port_scan or detect_beaconing, though no sibling is named explicitly.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no guidance on when to reach for this tool versus other detect_* siblings, no prerequisites (e.g., which pcap types are supported, whether decrypted traffic is needed), and no exclusions. The agent must infer usage from the name alone.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations indicate read-only (readOnlyHint=true) which aligns with detection. Description adds specific behavioral traits: looks for large outbound transfers, DNS length anomalies, non-standard ports. No contradictions detected.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Single sentence with front-loaded '[Anomaly]' category. Every word is informative; no redundancy or filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Lacks details on output format or result interpretation, which is important for a detection tool. However, given sibling tools have similarly sparse descriptions and no output schema exists, it is minimally adequate for basic usage.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, and the tool description provides no additional meaning for parameters 'pcap_file' or 'limit'. Agent receives no guidance on how to use parameters beyond schema types and defaults.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

Clearly specifies the tool detects data exfiltration with concrete examples (large outbound transfers, DNS length anomalies, non-standard ports). Distinguishes from sibling tools like wireshark_detect_dns_tunnel and wireshark_detect_port_scan by focusing on exfiltration patterns.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Implies use for exfiltration detection but no explicit guidance on when to use this vs alternatives like wireshark_detect_beaconing or wireshark_detect_dns_tunnel. Does not mention exclusions or prerequisites.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations declare readOnlyHint=true, so safety is clear. Description adds that threshold defines 'min unique dst ports to flag', which clarifies behavior. No contradictions.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences with no redundant words. Front-loaded with purpose, then parameter hint.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

No output schema, and description does not mention return format or what information is provided after detection. Important missing context for an analysis tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%. Description explains threshold parameter but omits any description for pcap_file (required). Only partial compensation for schema gap.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

Clearly states 'Detect port scanning' with specific scan types (SYN, FIN, NULL, Xmas). Provides security context and distinguishes from sibling detection tools like exfiltration or ARP spoofing.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Implies usage for security analysis but lacks explicit when-to-use guidance or alternatives. The threshold parameter hint is helpful but not enough to differentiate from other detection tools.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations indicate readOnlyHint=true, so the tool is safe and non-destructive. The description adds context about detecting anomalies but lacks details on output behavior or limitations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence with a front-loaded label '[Anomaly]'. Every word is meaningful and there is no redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a detection tool with no output schema, the description could be more complete. It does not explain the return format or what constitutes an anomaly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0% and the description does not explain the parameters. 'pcap_file' and 'limit' are left for the agent to infer from the schema alone.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool detects protocol anomalies and provides specific examples (known protocols on non-standard ports, unusual distributions). This differentiates it from sibling detection tools like ARP spoofing or DoS detection.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is provided on when to use this tool versus alternatives. There is no mention of prerequisites or exclusions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare destructiveHint=true and readOnlyHint=false, so the agent knows this is a mutating operation. The description usefully adds the sliding-window semantics and the default of 5 packets, which is behavior not encoded anywhere else. However, it omits key behavioral facts for a destructive tool: whether output_file is overwritten if it exists, and whether the input is left untouched.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

A single front-loaded sentence with no filler; the core action and its default are stated immediately. It is lean to the point of under-specification, but nothing in it is wasted.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a destructive, file-writing tool with no output schema and 0% parameter documentation, the description should cover output file behavior, overwrite semantics, and the relationship to the other editcap tools. It provides only the window default, leaving an agent to guess the rest.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% and the description only clarifies one of three parameters (duplicate_window, including its default). The semantics of input_file and output_file — notably whether output_file is created or overwritten — are left entirely to inference, so the description does not compensate for the coverage gap.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource ('Remove duplicate packets') plus the mechanism ('sliding window'), so an agent knows exactly what operation is performed. It does not explicitly contrast itself with the close siblings wireshark_editcap_trim, wireshark_editcap_split, or wireshark_editcap_time_shift, so it falls short of full sibling differentiation.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no guidance on when to prefer this tool over the other editcap-family tools or over merge/aggregate operations. No prerequisites, no exclusions, no mention of when deduplication is appropriate (e.g., after capture merge).

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already indicate destructiveHint=true and readOnlyHint=false, so the safety profile is partly covered. The description adds nothing beyond the basic action: it does not mention output file naming, overwrite behavior, whether the input file is preserved, or any permissions or rate limits.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, front-loaded sentence with no filler. It efficiently states the action and the two splitting criteria without unnecessary words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with four parameters, no output schema, and destructive write behavior, the description is too sparse. It omits required parameter semantics, the interaction between the two optional criteria (and their default 0 values), and any behavioral details about the resulting files.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 0% schema description coverage, the description must compensate. It only maps to two optional parameters (packets_per_file and seconds_per_file) through 'packet count or interval', while the required input_file and output_prefix parameters receive no additional meaning beyond their names.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb (split) and resource (capture into smaller files), and adds the splitting method (by packet count or interval). It is clear but does not explicitly differentiate from sibling tools like wireshark_editcap_trim or wireshark_editcap_deduplicate.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives no explicit guidance on when to use this tool versus alternatives such as trim, deduplicate, or time_shift. Usage is only implied by the verb 'split' and the two criteria, leaving the agent to infer the context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare destructiveHint=true, readOnlyHint=false, and openWorldHint=false. The description adds that all packet timestamps are shifted by an offset, but does not clarify whether input_file is modified in place or a new output_file is written, nor any permissions or reversibility behavior. Significant gap for a destructive tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

A single front-loaded sentence states the action, scope, and offset direction without filler. It is appropriately sized for what it conveys.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a destructive file-processing tool with three required parameters and no output schema, the description leaves essential operational context undocumented: what input_file and output_file mean, whether the original is preserved, and what the tool returns. Incomplete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% with three required parameters. The description explains only that 'seconds' is a positive or negative offset, adding sign semantics beyond the parameter name, while input_file and output_file remain entirely undocumented.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (Adjust), resource (packet timestamps), scope (all), and parameter meaning (positive/negative offset in seconds). It is distinguishable from timestamp-unrelated editcap siblings, but it does not explicitly differentiate itself from editcap_trim, editcap_split, or editcap_deduplicate.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

No when-to-use guidance, prerequisites, or alternatives are provided. The agent must infer that this is for timestamp correction rather than trimming, splitting, or deduplicating.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already indicate destructiveHint=true. The description does not elaborate on the behavior (e.g., overwriting output file, requiring both start and stop times). It adds no behavioral context beyond the annotation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise (one sentence) but at the cost of missing essential information. It is front-loaded but incomplete.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With 4 parameters, no output schema, and minimal description, the tool lacks necessary context. The description does not explain default behavior when start_time/stop_time are empty, nor the effect of output file overwriting.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%. The description mentions 'Times in editcap format' but does not explain the format for start_time or stop_time, nor the meaning of input_file/output_file. No parameter semantics are clarified.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool trims a capture to a timestamp window using editcap format. While it doesn't explicitly differentiate from sibling tools like editcap_split or editcap_time_shift, the action of trimming to a time window is specific enough.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this tool versus alternatives, nor any prerequisites. The description is purely declarative without contextual usage advice.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The annotations already declare destructiveHint=true, indicating file creation. The description adds the protocol options but does not disclose other behaviors (e.g., overwrite behavior, whether extraction preserves metadata). The description is adequate given the annotation coverage.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is very concise (one short sentence) and front-loaded with an '[Export]' label. It efficiently communicates the core purpose and protocol list. Slightly more structure could improve readability.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given 3 required parameters, a destructive hint, and no output schema, the description lacks details on return values, error conditions, and output format. It feels incomplete for an agent to fully understand the tool's behavior and side effects.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 0% schema description coverage, the description should explain all parameters. It only partially clarifies 'protocol' by listing values, but 'pcap_file' and 'dest_dir' remain completely unexplained. This is insufficient for an agent to correctly invoke the tool.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states 'Extract embedded files from traffic' with specific protocol options (http, smb, tftp, imf, dicom). This distinguishes it from sibling tools like wireshark_extract_credentials or wireshark_extract_dns_queries, which focus on different data types.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description lists acceptable protocols, giving some usage context, but does not explicitly state when to use this tool over alternatives like wireshark_follow_stream or wireshark_extract_http_requests. No 'when not to use' guidance is provided.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The annotation readOnlyHint: true confirms no modification, and 'Scan' aligns with read-only behavior. The description adds context about scanning specific credential types, but does not detail output format or any side effects.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence with a front-loaded tag, making it efficient. However, it is somewhat terse and could include more detail without sacrificing conciseness.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple tool with one parameter and no output schema, the description covers the basic intent but omits return value details and protocol coverage scope beyond examples. It is minimally adequate.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 0% schema description coverage, the description should compensate, but it does not mention the 'pcap_file' parameter at all. The parameter's purpose is obvious from the tool name, but no constraints or examples are provided.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool scans for plaintext credentials, listing specific protocols like HTTP Basic Auth, FTP, and Telnet. This distinguishes it from sibling tools such as wireshark_extract_http_requests or wireshark_extract_dns_queries, which focus on different data extraction.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description starts with '[Security]', indicating its domain, and the protocol examples imply when to use it (when looking for plaintext credentials). However, it lacks explicit instructions on when not to use it or alternatives, though the sibling list provides context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, so the agent knows it is a safe read operation. The description adds value by specifying the output format (TSV) and exact extracted fields, providing behavioral context beyond what annotations convey. No contradictions.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is extremely concise: a single line with a categorization prefix and clear verb-object-output. Every word adds value, and the core action is front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given low complexity and no output schema, the description covers the basic purpose but misses details like column order of the TSV, explanation of the limit parameter, or any limitations. It is minimally adequate.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, placing full burden on description to explain parameters. The description does not mention pcap_file or limit, leaving the agent to infer meaning from names alone. This is insufficient for a 2-parameter tool with no schema descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action (extract), resource (DNS queries from pcap file), and output format (TSV). It specifies the extracted fields (name, type, response flag), which distinguishes it from sibling extraction tools like wireshark_extract_credentials or wireshark_extract_http_requests.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this tool versus alternatives (e.g., wireshark_detect_dns_tunnel, wireshark_export_objects). The description does not mention prerequisites, use cases, or when not to use it, leaving the agent without context for selection.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations declare readOnlyHint=true (safe read) and openWorldHint=false. The description adds value by specifying the output format (TSV, 'Tabular') and the field parameter format (comma-separated). However, it does not mention pagination behavior (limit, offset) or the effect of display_filter, though these are present in the input schema. The description goes beyond annotations but could still be improved.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is very concise at one sentence plus an example, front-loading the key purpose and format. It is efficient but could be slightly more structured without becoming verbose. Every word earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given 5 parameters, no output schema, and many sibling tools, the description is incomplete. It covers output format and field specification but omits critical details about file selection, pagination (limit/offset), and filtering (display_filter). An agent would lack context for correct invocation, especially alongside tools like wireshark_get_packet_list or wireshark_search_packets.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must explain parameters. It only explains the 'fields' parameter with an example. The other four parameters ('pcap_file', 'limit', 'offset', 'display_filter') receive no explanation, leaving the agent uncertain about their purpose or defaults.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool extracts fields as TSV, with a specific verb ('Extract'), resource ('fields'), and output format ('TSV'). It provides an example of comma-separated field syntax, which differentiates it from sibling tools that extract specific data types (e.g., credentials, DNS queries) or return full packets.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description lacks guidance on when to use this tool versus siblings like wireshark_extract_credentials or wireshark_get_packet_list. It does not mention alternatives or provide context for preferring this over other extract or packet tools. The usage is implied but not explicitly stated.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and openWorldHint=false, so safety is covered. The description adds genuinely non-derivable context: matching is optional, it runs against user-maintained local lists, and hits should be treated as leads rather than confirmed findings. It stops short of disclosing what the limit bounds or how results are ordered.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short sentences, front-loaded with the forensics tag and the verb+resource, with no filler. It is efficient but borders on cryptic — the compressed phrasing leaves key operational detail unstated.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

There is no output schema, so the description should explain the shape of the return (fingerprint records, hash values, matched-list hits), and it does not. Combined with undocumented parameters, an agent knows what the tool is for but not what it will get back or how to size the request.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must carry parameter meaning and it does not. pcap_file is inferable from its name, but 'limit' (default 100) is never explained in either place — it is unclear whether it caps fingerprints, matched flows, or packets scanned.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (Extract) and resource (JA3/JA3S TLS fingerprints), plus the optional list-matching behavior. No sibling tool produces TLS fingerprints, so the agent can distinguish it from wireshark_decrypt_tls, wireshark_verify_ssl_decryption, and the generic extract_* tools without opening a schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The [Forensics] tag and the fingerprint subject imply the use case (TLS client/server fingerprint profiling of a capture), but no when-to-use condition, prerequisite, or named alternative is given. 'Treat matches as leads' is interpretive guidance rather than routing guidance, so usage is only implied.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description discloses that it creates a new pcap file, consistent with the destructiveHint annotation. It adds value by specifying that it extracts ranges (implying reading from original and writing new), which is beyond the annotation's binary destructive flag.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is extremely succinct: one short sentence and a format example. Every word adds value, and it is front-loaded with the key action.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's simplicity (3 required params, no output schema, annotations covering destructive hint), the description is complete enough for an AI agent to understand the tool's basic usage. However, it lacks details about return values, overwrite behavior, or prerequisites (e.g., existing pcap file).

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The description adds meaning for the 'frame_ranges' parameter by providing an example format ('1-10 15 20-30'), which is not clear from the schema alone. Other parameters (pcap_file, output_file) are self-explanatory from their names, so no additional explanation is needed.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool extracts specific frame ranges to a new pcap, with a clear example of the range format. It distinguishes itself from siblings like wireshark_editcap_split by focusing on frame number ranges rather than time or split criteria.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explains what the tool does and provides a format example, but does not explicitly guide when to use it vs alternatives (e.g., editcap_split for splitting by time or packets). Usage context is implied but not made explicit.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and openWorldHint=false. The description adds the output format (TSV) and the extracted fields, which is useful context. However, it does not disclose that the 'limit' parameter truncates results or that only the first N requests are returned.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, front-loaded sentence with no unnecessary words. It efficiently conveys the tool's core purpose and output format.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple extraction tool with two parameters and no output schema, the description covers basic purpose and format. However, it lacks details on parameter behavior and potential edge cases (e.g., non-HTTP PCAPs), leaving gaps in completeness.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate. It mentions extracted fields but does not describe the 'pcap_file' or 'limit' parameters. The agent is left to infer that 'pcap_file' is the input PCAP and 'limit' controls request count, but no explicit clarification is given.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool extracts HTTP request details (method, URI, host, user-agent) and outputs as TSV. This specific verb and resource distinguish it from sibling tools like wireshark_extract_credentials or wireshark_extract_dns_queries.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides no guidance on when to use this tool versus alternatives (e.g., wireshark_extract_fields). It does not mention prerequisites (e.g., pcap must contain HTTP traffic) or cases where another tool would be more appropriate.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations include destructiveHint: true, and the description says 'save to a new file', which implies creating a new file (destructive). However, it does not clarify that the original file remains unchanged (not in-place modification) nor mention potential overwriting behavior. No contradictions with annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, efficient sentence with no wasted words. It conveys the core action. However, it could be slightly more structured (e.g., split into action and details) without adding length.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the complexity of Wireshark display filters (syntax, operators) and numerous sibling tools, the description is too minimal. It does not explain what a display filter is or how to format it, what output file format is used, or any side effects. No output schema exists to compensate.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Input schema has 3 required parameters with 0% description coverage. The description only mentions parameter names implicitly ('input_file, output_file, display_filter'), but provides no additional semantics such as expected file paths, formats, or display filter syntax. The description fails to compensate for the schema's lack of detail.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states 'Filter packets from a pcap and save to a new file using a Wireshark display filter', which precisely identifies the verb (filter/save), resource (pcap file), and distinguishes from siblings like wireshark_editcap_split (which splits by time) or wireshark_merge_pcaps (which merges).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description does not provide explicit guidance on when to use this tool vs alternatives, nor does it mention prerequisites or limitations. However, the purpose is clear enough that an agent can infer its use for filtering, but lacks exclusionary context given the large sibling list.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description is consistent with readOnlyHint=true, confirming no destructive behavior. It adds the types of flow graphs but does not describe any side effects, performance implications, or limitations beyond what annotations provide.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is very short (one sentence) and front-loaded with the purpose. It is concise but lacks structure (e.g., not separating purpose from details). Every word is useful, but could be slightly expanded for clarity.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description should clarify what the tool returns (e.g., an image, text, or data). It only states it 'shows' a graph, leaving ambiguity about output format. Given the tool's complexity (flow graph), more context would help.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%, so description must compensate. It lists the three types for flow_type (any, tcp, icmp), which adds meaning beyond the schema's default. However, pcap_file parameter is not described, and overall parameter documentation is minimal.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool generates a flow/sequence graph showing packet exchange, with specific types listed (any, tcp, icmp). This distinguishes it from sibling tools like wireshark_stats_protocol_hierarchy or wireshark_stats_io_graph, which have different purposes.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

No explicit guidance on when to use this tool versus alternatives. While the types are listed, there is no mention of context, prerequisites, or when not to use it. The description does not compare to sibling tools or clarify usage scenarios.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already indicate readOnlyHint=true, so the description's 'Reassemble stream' aligns with that. The description does not add any additional behavioral details beyond what annotations provide, but there is no contradiction.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is extremely brief (one line) and lacks structure. The bracketed '[Stream]' prefix is unclear. It does not effectively front-load key information; it is under-specified rather than concise.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the complexity (7 parameters, no output schema) and the minimal annotation coverage (only readOnlyHint), the description is incomplete. It does not explain required inputs, pagination mechanism, or how results are returned. Significant gaps remain for an agent to invoke correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 0% schema description coverage, the description must compensate. It only lists possible values for 'protocol' and 'output_mode' without explanation, and omits the other 5 parameters entirely (pcap_file, stream_index, limit_lines, offset_lines, search_content). This is insufficient to clarify parameter usage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description states 'Reassemble stream with pagination', which gives a clear verb and resource. It indicates the tool reassembles network streams and supports pagination. However, it lacks context to differentiate it from sibling tools like wireshark_flow_graph, and the term 'stream' could be ambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no guidance on when to use this tool versus alternatives such as wireshark_get_packet_list or wireshark_search_packets. No prerequisites, use cases, or conditions are mentioned.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, and the description reinforces that by calling it an 'enrichment' operation. It adds value by disclosing the dependency on an external database (GeoLite2 DB), which is beyond the annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is extremely concise with a single sentence that front-loads the category '[Enrichment]' and includes essential details. No superfluous information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers the core purpose and a key dependency, but lacks parameter explanations and output specifications. For a tool with no output schema, the description should provide more context about the enrichment results.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%, but the description fails to explain the two parameters (pcap_file, limit). The tool's purpose implies pcap_file is input and limit controls IP count, but no explicit guidance is given, leaving the agent to infer meaning.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool performs GeoIP enrichment for unique IPs, providing country, city, ASN. It specifies the need for a GeoLite2 DB, making the purpose unambiguous and distinct from sibling tools like extraction or analysis tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly mentions the prerequisite of a GeoLite2 DB, which guides when to use the tool. However, it does not mention when not to use it or alternatives among the many sibling tools, slightly reducing guidance completeness.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, so description does not repeat that. It adds value by specifying the output nature (list of available tools and versions), which helps the agent understand what to expect.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Single sentence, front-loaded with key information. No unnecessary words; every part adds value.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no parameters, no output schema, and a simple purpose, the description is fully adequate. It explains what the tool returns without needing detailed schema.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

No parameters exist. Schema coverage is 100% for zero parameters, so description does not need to add parameter info. Baseline score of 4 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

Description clearly states the tool retrieves capabilities (available tools and versions) for the MCP server instance. Verb 'Get' and resource 'capabilities' are specific, and the tool is distinct from all siblings which are operational tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

No explicit guidance on when to use this tool vs alternatives. Usage is implied as a meta-tool for discovery, but no when-not or alternative mentions are provided.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true. The description adds that the tool uses capinfos and returns metadata, providing minimal extra behavioral context beyond the annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Single sentence front-loaded with the key action and result. No filler words, every part serves a purpose.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple tool with one parameter and no output schema, the description conveys the essential purpose and output fields. Lacks explicit return format but lists metadata types, which is adequate.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 0% schema description coverage, the description carries full burden but only lists the parameter name (pcap_file) without specifying format, constraints, or examples. The description does not compensate for the schema gap.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly specifies the verb 'Get' and resource 'capture file metadata', listing specific fields (type, packet count, duration, size). It distinguishes this tool from siblings that focus on packets, statistics, or capture operations.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this tool versus alternatives like wireshark_open_file or wireshark_quick_analysis. The description mentions 'via capinfos' but does not explain context for choosing this tool.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already indicate readOnlyHint=true. Description adds the context of output format (hex/ASCII dump) and confirms it's a single packet operation. No contradictions.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Extremely concise (5 words after the bracketed tag). Every word carries meaning, but lacks structure or additional context that could improve usability.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple tool with two required parameters and no output schema, the description is minimal. It does not explain parameter constraints, expected input formats, or return structure, leaving the agent underspecified.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, meaning the schema has no parameter descriptions. The tool description does not explain the parameters (pcap_file, frame_number) at all, leaving the agent with only the parameter names.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

Description clearly states it returns a raw hex/ASCII dump of a single packet, using a specific verb+resource. The [Bytes] prefix and mention of raw dump distinguish it from siblings like wireshark_get_packet_details or wireshark_get_packet_list.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this tool versus alternatives. No mention of when-not-to-use or prerequisites. The agent must infer from the tool name and description alone.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations declare readOnlyHint=true, so the description does not need to reiterate that. The description adds that the tool retrieves packets surrounding a frame, which implies a read operation. However, it does not disclose how the 'context' is bounded, what happens if count is too large or frame_number is missing, or any performance implications.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is very concise, consisting of one sentence. It is front-loaded with a '[Context]' tag that likely signals the type. While concise, it could benefit from slightly more structure without adding length.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool has three parameters and no output schema, the description is too brief. It does not describe the output format, the relationship between count and the number of packets returned, or what 'surrounding' means (e.g., does it include the frame itself?). The agent lacks sufficient information to use the tool confidently.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, yet the description only mentions 'count' vaguely ('count before and after'). It does not explain pcap_file or frame_number, nor does it indicate that count has a default value of 5. The agent must infer most parameter meanings from context, which is insufficient.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool gets packets surrounding a specific frame with a count before and after. It uses a specific verb 'get' and identifies the resource 'packet context'. Among sibling tools like wireshark_get_packet_list and wireshark_get_packet_details, this description differentiates the tool's purpose well.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides no guidance on when to use this tool versus alternatives. It lacks any mention of prerequisites, limitations, or when not to use it. For example, it does not differentiate from wireshark_get_packet_list or wireshark_get_packet_details.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already indicate readOnlyHint=true, so the description's claim of returning full JSON is consistent. However, it does not disclose any behavioral traits beyond what annotations provide, such as return format details or error handling. For a read-only tool with annotations, the description adds minimal value.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is very short (two sentences) and front-loaded with '[Detail]'. It is efficient but could be more structured by clearly separating the main purpose from parameter details.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no output schema and low parameter description coverage, the description is incomplete. It explains the layers parameter but omits purpose and format for 'pcap_file' and 'frame_number'. Additionally, it does not describe what the JSON output contains, leaving the agent with insufficient information for reliable use.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The description explains only the 'layers' parameter as a 'comma-separated protocol filter'. It fails to describe the required parameters 'pcap_file' and 'frame_number', which are critical for usage. With 0% schema description coverage, the description only partially compensates, leaving two of three parameters unexplained.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description explicitly states it returns 'Full JSON for one packet' and explains the layers parameter as a protocol filter. This clearly distinguishes it from sibling tools like 'wireshark_get_packet_list' (multiple packets) and 'wireshark_get_packet_bytes' (raw bytes).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives a brief hint about using the layers parameter but lacks explicit guidance on when to use this tool versus alternatives. Usage is implied from the name and context, but no when-to-use or when-not-to-use is stated.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already indicate readOnlyHint=true, and the description confirms it returns a packet list. It adds some behavioral context by specifying the TSV output format and custom_columns option, but does not discuss limit/offset behavior or potential errors. With annotations covering the safety profile, the description provides modest additional insight.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is very short, which is concise but lacks structured details. It uses a summary format with brackets and abbreviations, which may be unclear. While not verbose, it could be better organized with clear sentences.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description should fully explain return values and parameter effects. It specifies the TSV columns but not the impact of limit, offset, or display_filter. For a 5-parameter tool with no parameter descriptions, the description is incomplete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must explain parameters. It only briefly mentions custom_columns. The purpose of limit, offset, pcap_file, and display_filter are not explained. The description adds minimal value beyond the schema's parameter names and types.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it returns a packet list with specific columns (TSV format). It distinguishes from sibling tools like get_packet_details by focusing on the top pane list. However, it does not explicitly state that the list is for a given pcap file, which is implied by the required parameter.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this tool vs alternatives such as wireshark_get_packet_details, wireshark_read_packets, or wireshark_quick_analysis. The description lacks context for choosing this tool over others.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, so the description is consistent but adds minimal extra behavior beyond 'for capture'. No additional insights like platform-specific behavior or sudo requirements are disclosed.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

A single, concise sentence that conveys the tool's purpose without any redundancy or unnecessary details.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description is clear for a simple listing tool with no params. However, it does not mention the output format (e.g., list of names, objects), which could aid agent expectations. Minor gap.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With zero parameters, the schema covers all cases. The description adds no param info, but per guidelines baseline is 4 for no parameters. Description is sufficient.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool lists available network interfaces for capture, directly matching the name and resource. It distinguishes itself from sibling tools which focus on capture, stats, detection, etc.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

No explicit when-to-use or when-not-to guidance is provided. Usage is implied as a prerequisite for capture, but alternatives like wireshark_get_capabilities exist. A brief note on context would improve clarity.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Description adds minimal behavioral context beyond the destructiveHint annotation. Does not disclose whether output file will be overwritten, required file permissions, or error handling.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Extremely concise—one sentence plus a fragment. Every word earns its place, but structure could be improved (e.g., separating parameter details into a list).

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

No output schema and limited parameter documentation. Missing important context: file format requirements, size limits, behavior if input files don't exist, and typical use cases.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Input_files parameter gets partial description ('comma-separated paths') but output_file is entirely unexplained. With 0% schema coverage, description should compensate more for the missing parameter semantics.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description 'Merge multiple capture files into one' is a clear, specific verb+resource statement that distinctly identifies the tool's function compared to sibling tools like wireshark_editcap_split.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this tool instead of alternatives or prerequisites. The description only provides parameter format ('comma-separated paths') without context for usage decisions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The annotations already indicate readOnlyHint=true, so the description's mention of 'Open a pcap' is consistent. The description adds value by stating it returns protocol-aware recommendations, but does not disclose any additional behavioral traits like authentication needs or file size limits.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is short and to the point, with two sentences that front-load the entry point label. It is efficient but could be slightly improved with more structure.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given that this is an entry point tool with many sibling analysis tools, the description lacks crucial details such as how to provide the pcap file, output format, and any prerequisites. This incompleteness risks incorrect tool usage.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 0% schema description coverage, the description does not explain the meaning of the 'pcap_file' parameter (e.g., file path, URL, or content). The parameter name alone is insufficient for correct invocation, and the description fails to compensate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool opens a pcap file and returns protocol-aware tool recommendations. It identifies itself as an entry point, which helps distinguish it from sibling tools that perform analysis or extraction. However, it does not explicitly differentiate from all siblings.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description labels the tool as '[Entry Point]', implying it should be used first, but does not provide explicit guidance on when not to use it or what alternatives exist. The usage context is implied rather than clearly stated.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already mark readOnlyHint=true, consistent with an analysis tool. Description adds no additional behavioral traits (e.g., performance impact, data volume). It does not contradict annotations, but provides minimal extra context beyond what annotations convey.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Single sentence listing outputs is fairly concise, but the list is somewhat lengthy. Overall proportion seems appropriate for the tool's purpose.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Tool has no output schema, low schema coverage, and many siblings. Description is too brief to equip an agent with full understanding of usage, output expectations, or how this differs from other tools. Incomplete for a tool that appears to be an aggregate analysis.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Input schema has one parameter 'pcap_file' with 0% coverage in description. The description does not explain the parameter beyond the schema's bare definition. With low schema coverage, the description fails to compensate by adding meaning or format details.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

Description specifies verb 'quick analysis' on 'pcap file' and lists outputs (file info, protocols, top talkers, conversations, hostnames, anomalies), indicating a comprehensive overview. However, it does not differentiate from sibling tools like wireshark_get_file_info or wireshark_stats_*, so clarity is good but not excellent.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this tool versus alternatives. The description labels it as 'One-call traffic overview', implying an initial summary, but lacks explicit context or exclusions regarding when to use other specific tools like wireshark_stats_* or wireshark_detect_*.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description adds deprecation context, but no other behavioral details beyond what annotations (readOnlyHint=true) already convey. It does not contradict annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise with a single sentence and starts with the key 'DEPRECATED' flag, but it could include a brief note on what 'JSON packet data' means.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

While deprecation is flagged, the description is too minimal for a tool with 4 parameters and no output schema; agents lack context on return format or how to use parameters if they attempt to use it.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The description mentions no parameters, and schema coverage is 0%, leaving the agent to rely solely on parameter names and types without any semantic guidance.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool provides 'JSON packet data' and marks it as deprecated, which identifies its purpose despite lacking specificity about the data source or structure.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly tells the agent to use 'get_packet_list + get_packet_details instead', offering clear guidance on alternatives and when not to use this tool.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and openWorldHint=false, so the safety profile is covered. The description adds a genuinely useful caveat: 'Hits require object extraction and verification', warning that raw counts are unverified and need follow-up. It does not clarify that output is only counts (not packet lists) or what signatures are matched.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short sentences, front-loaded with purpose and followed by the actionable verification caveat. No waste, though the bracketed category tag is the only structural cue.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple read-only scanner with annotations covering safety and no output schema, the description gives purpose and one important caveat. It omits what 'common file signatures' means, what the counts represent, and how to follow up on hits, leaving moderate gaps.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% for the single required pcap_file parameter. The name is largely self-explanatory, but the description adds no syntax, format, or constraint details beyond the schema and does not reference the parameter at all.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource: 'Count packets containing common file signatures', with a [Forensics] category tag. It is distinguishable from wireshark_yara_scan (rule-based) and wireshark_extract_fingerprints, but never explicitly names or contrasts those siblings.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

No when-to-use vs when-not guidance and no alternatives named. The agent is not told when to pick this over wireshark_yara_scan, wireshark_export_objects, or wireshark_extract_fingerprints, all of which overlap with signature-based forensic scanning.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, so the description adds no extra behavioral context beyond stating the purpose. It does not disclose behavior like return format, pagination, or what happens on no match. With annotations covering the safety profile, the description should at least mention non-obvious traits.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is extremely concise at one sentence, which is efficient but under-specified. It earns its place by stating the core purpose, but omits critical details. Conciseness should not come at the cost of completeness, so a midpoint score is appropriate.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool has 5 parameters (including two enums), no output schema, and many sibling tools, the description is incomplete. It does not address how parameters interact, supported search types, or scope values, leaving significant gaps for the agent.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, and the description only implies the purpose of match_pattern. It fails to explain the other four parameters (pcap_file, limit, scope, search_type), including their defaults and enums. For a tool with 5 parameters, the description is severely lacking.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description 'Find packets by content' clearly states the action (find) and resource (packets) with a specific method (by content). It distinguishes from siblings like wireshark_get_packet_list (which likely just lists without search) and wireshark_read_packets (raw reading). However, it doesn't explicitly mention the pcap file context or contrast with other search-like tools, so not a perfect 5.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides no guidance on when to use this tool versus alternatives such as wireshark_get_packet_list or wireshark_detect_port_scan. It lacks any when-to-use, when-not-to-use, or prerequisite information, leaving the agent without decision support.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description claims the tool 'overrides' preferences, implying a write operation, but annotations set readOnlyHint=true, contradicting the description. The description does not clarify that changes are temporary or only affect the current session, nor does it disclose any side effects.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is short and front-loaded, but it sacrifices necessary detail. While concise, it fails to convey key information, making it underinformative.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With 5 parameters, no output schema, and a potentially destructive action (overriding preferences), the description is far too minimal. It does not explain return values, side effects, or usage constraints.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0% and the description does not explain any parameters beyond a brief example. The prefs format is shown but not formally defined; other parameters (limit, fields, pcap_file, display_filter) are completely ignored.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description states 'Protocol preference overrides' and provides an example, indicating the tool sets dissection preferences. However, it lacks a clear verb (e.g., 'set') and does not distinguish it from similar tools like decode_as or decrypt_tls.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is given on when to use this tool versus alternatives (e.g., wireshark_decode_as). There is no context about prerequisites or exclusion criteria.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations (readOnlyHint=true) already indicate safety; description adds list of valid types but doesn't detail behavior like aggregation or filtering. Acceptable but minimal extra transparency.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Extremely concise, single sentence with clear purpose and parameter options. No wasted words; front-loads key information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

No output schema, so description could have described return format or stats columns. Adequate for a simple tool but leaves the agent guessing about output shape.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema has 0% coverage; description explicitly lists all allowed values for 'type', adding meaning beyond raw schema. Missing description for 'pcap_file' but parameter name is self-explanatory.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

Description clearly states it retrieves communication pairs and stats, and lists supported types. Distinguishes from siblings like endpoints or protocol hierarchy, but could be more specific about what stats are returned.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this tool over alternatives (e.g., endpoints for unidirectional flows). No when-not-to-use or context provided.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description is consistent with the readOnlyHint annotation (no destructive behavior). However, it does not add extra behavioral context beyond what annotations provide, such as the scope of 'all endpoints' or whether results are aggregate. Given annotations, a score of 3 is appropriate.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is very short and front-loaded with '[Endpoints]', which helps in scanning. It wastes no words, but the brevity sacrifices completeness in other dimensions. Still, it is appropriately sized for a simple tool.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no output schema and minimal annotations, the description should explain what the tool returns (e.g., a list of endpoints with metrics). It does not address the return value, nor does it elaborate on the pcap_file parameter. This is insufficient for an agent to understand the tool's full behavior.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate. It only explains the 'type' parameter by listing valid values, but does not define them or describe the required 'pcap_file' parameter at all. This leaves significant ambiguity for the agent.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb 'List', the resource 'endpoints', and includes 'traffic stats', making the tool's purpose explicit. It also lists valid protocol types, which distinguishes it from sibling stats tools like wireshark_stats_conversations or wireshark_stats_protocol_hierarchy.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no guidance on when to use this tool over alternatives like wireshark_stats_conversations or wireshark_stats_protocol_hierarchy. The description only implies usage for endpoint listing but provides no exclusion criteria or context for selection.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already indicate readOnlyHint=true. The description adds context about the types of anomalies detected (retransmissions, errors, etc.) but does not disclose other behavioral aspects such as performance impact or file requirements. With annotations present, this is adequate but minimal.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is very short and front-loaded with a label. However, it lacks crucial details about parameters and output, making it incomplete. It is concise but at the expense of clarity.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's simplicity (one parameter, no output schema, safe read operation), the description is insufficient. It does not describe the output format or provide any example. An agent would need to infer what 'expert info' returns, which affects usability.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, and the tool description does not explain the single required parameter 'pcap_file'. While the parameter name is self-explanatory, the description should explicitly state it is the packet capture file to analyze. This omission leaves ambiguity for unfamiliar agents.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it is about 'Expert Info' for automatic anomaly detection and lists specific anomalies (retransmissions, errors, etc.). It distinguishes from sibling detection tools by referencing the Wireshark expert info feature, though it does not explicitly contrast with tools like wireshark_detect_protocol_anomalies.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this tool versus alternatives. The description implies it provides automatic expert info but does not specify appropriate contexts, prerequisites, or cases where other detection tools would be more suitable.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The annotations declare readOnlyHint=true and openWorldHint=false, so the safety profile is already covered. The description adds that results are bucketed by time and can be split by semicolon-separated display filters, but it does not describe the return format, aggregation semantics beyond bucketing, or any performance limits.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is one compact sentence that front-loads the graph type and main output, with no filler. It is appropriately sized for a brief label, though the extreme brevity contributes to gaps in other dimensions.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a stats-generation tool with no output schema and three schema parameters at 0% description coverage, the single sentence is insufficient. It does not explain the required pcap_file, the interval parameter, or what the I/O graph result contains.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must carry parameter meaning, but it only explains filters as semicolon-separated display filters. It never mentions pcap_file, which is required, or interval, leaving two of three parameters undocumented.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific resource and output ('I/O Graph', 'Traffic volume by time bucket') and notes optional filter splitting. It distinguishes itself from packet-level siblings and other stats tools by naming the graph type, though it lacks an explicit verb like 'generate' or 'compute'.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no guidance on when to choose this tool over siblings such as wireshark_flow_graph, wireshark_stats_endpoints, or wireshark_stats_conversations. Only an implied use for time-bucketed traffic volume is present, with no exclusions, prerequisites, or alternatives named.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true. The description adds no behavioral details beyond a generic 'showing distribution', e.g., no mention of whether it modifies anything or any side effects.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Extremely concise (one sentence) but lacks substantive information. Could be improved without losing brevity.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

No output schema exists, and the description offers no explanation of the return format (e.g., list of protocols with percentages or counts). Incomplete for a single-parameter tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The only parameter, pcap_file, is not described in the schema or description. The description provides no meaning about how to specify the capture file (path, content, format).

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description states it shows protocol hierarchy statistics with distribution, but it's vague and doesn't differentiate from sibling stats tools like wireshark_stats_endpoints or wireshark_stats_conversations.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this tool versus alternatives among the many statistical tools in the sibling list.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare `readOnlyHint: true`, indicating safe read-only behavior. The description adds minimal extra context: it identifies the tool as providing statistics but does not disclose any side effects, dependencies, or what happens on failure. No contradictions with annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence with no extraneous words. It is front-loaded with the key concept ('Service response time statistics'). However, at the cost of comprehensiveness, it does not elaborate on output or usage.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the low schema coverage, no output schema, and the presence of many sibling tools, the description is insufficient. It does not explain what the statistical output contains (e.g., format, fields) or how the protocol filter affects results. A more complete description would at least mention return values or provide an example.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0% (no parameter descriptions in schema), so the description must fill the gap. It mentions the `protocol` parameter with example values, which adds some meaning beyond the schema (which only shows type and default). However, it does not describe the required `pcap_file` parameter, leaving its semantics entirely to the agent's inference. A more complete description would explain both parameters.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description states it provides 'service response time statistics' and lists example protocols, but it does not explain what specific statistics are computed (e.g., average, min, max). The abbreviation 'SRT' is not expanded, which may confuse agents. While it differentiates from sibling stats tools by focusing on response time, the lack of detail reduces clarity.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this tool versus alternative stats tools like `wireshark_stats_io_graph` or `wireshark_stats_protocol_hierarchy`. The description does not mention prerequisites, limitations, or context where this tool is appropriate.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare destructiveHint=true, indicating potential file modification. The description adds no behavioral context beyond stating the conversion action, such as whether it overwrites output files or requires external tools like text2pcap.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise with one sentence and a brief note on encapsulation. It is front-loaded with the core purpose, though parameter details could be better integrated.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given 5 parameters with no schema descriptions and no output schema, the description is incomplete. It lacks explanations for three of the five parameters, usage context, and output behavior, making it insufficient for an agent to use correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, yet the description only explains the encapsulation parameter (default ether). It does not clarify the purpose of ascii_mode, timestamp_format, or the required input/output file parameters, leaving significant ambiguity for the agent.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool converts ASCII or hex dump into a capture file using text2pcap, specifying the input format and output type. It distinguishes from sibling tools, as no other tool performs this conversion.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage when you have ASCII or hex dump data, but does not provide explicit guidance on when to use this tool versus alternatives, nor does it mention prerequisites or limitations.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already indicate readOnlyHint=true, so the tool is read-only. The description adds context about using an SSLKEYLOGFILE-format keylog file, but does not disclose what happens on failure or any side effects, which is acceptable given the annotation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

One sentence with a [TLS] prefix for domain context. Efficient and front-loaded, though could be slightly expanded for clarity.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

No output schema and minimal parameter descriptions. The description does not explain what the tool returns (e.g., success/failure, details), error conditions, or input format specifics beyond the keylog hint. Incomplete for a verification tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must add meaning. It clarifies that keylog_file is an SSLKEYLOGFILE-format file, but pcap_file receives no extra context beyond being a string. This is insufficient for full semantic understanding.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description specifies the action (verify) and resource (TLS decryption) with the method (SSLKEYLOGFILE-format keylog file), distinguishing it from similar sibling 'wireshark_decrypt_tls' by implying verification rather than decryption.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this tool versus alternatives like 'wireshark_decrypt_tls'. No exclusions or context for selection are provided.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations indicate destructiveHint=true, but the description only describes a read-only 'scan' operation. This is a contradiction. No additional behavioral context (e.g., files modified, permissions needed) is provided.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is short and front-loaded with a '[Security]' tag, but it is somewhat cryptic and could benefit from clearer structure. It packs information into a few phrases, but some sentences are missing.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With 3 parameters and no output schema, the description should clarify input prerequisites and return values. It fails to mention that exported objects must exist first or what the scan results look like, leaving significant gaps.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%. The description adds meaning for the 'protocol' parameter by listing expected values (http|smb|tftp) but does not explain 'pcap_file' or 'dest_dir' beyond their existence in the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description states 'YARA scan exported files' with specific detection targets (malware, webshells, shellcode) and protocols (http|smb|tftp). This clearly identifies the verb and resource, and the security focus differentiates it from many sibling tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this tool versus alternatives like wireshark_detect_exfiltration or wireshark_scan_file_signatures. No prerequisites (e.g., exported files) or exclusions are mentioned.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.