zins_get_cyber_incidents_by_location

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already provide readOnlyHint=true, and the description adds that it is 'Read-only analytics'. It also discloses the window constraint and output format (one id/name/total row), which are not evident from annotations or schema. No contradiction.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise, front-loading the action and output, followed by use case and constraint. Every sentence adds value without fluff.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool has 7 parameters, no output schema, and low schema coverage, the description should provide more guidance on parameters and behavior. It covers grouping and window but leaves out parameter details and the fact that the defaults already set a 14-day window.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is low (14%), so the description must compensate. It adds meaning by mentioning grouping by location/app/user/department (hinting at the categorize_by parameter) and the window constraint, but does not explicitly describe other parameters like limit, start_time, etc.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb 'Get' and the resource 'cyber-security incidents grouped by location', with additional mention of grouping by app/user/department. It distinguishes itself from sibling tools like zins_get_cyber_incidents and zins_get_cyber_incidents_by_threat_and_app by specifying the grouping dimension and output structure.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides context for use: 'useful for ranking which sites carry the most incidents' and specifies the window constraint (7- or 14-day historical interval). However, it does not explicitly compare to alternatives or give when-not-to-use guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.