Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Goes well beyond the destructiveHint=true annotation: it explains that a new key immediately revokes the previous one so other clients break, that the key is shown once and only a hash is stored, that it is sent as the X-API-Key header, and that codes are single-use, expire in 15 minutes, and are invalidated after a few wrong attempts. This is exactly the operational context an agent needs before an irreversible action.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Three tight paragraphs, front-loaded with the purpose and the destructive consequence before the mechanics. Nearly every sentence adds decision-relevant information; nothing is filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a one-parameter destructive auth tool with an output schema, the description covers purpose, safety consequence, credential handling, and code lifecycle. An agent has everything required to call it correctly and warn the user beforehand.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%, so the description must carry the parameter. It does: it tells the agent the lone 'code' comes from the user's account page, is single-use, expires after 15 minutes, and is invalidated after wrong attempts. It omits any format/length detail, which is a minor gap.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource: 'exchanges a pairing code from the user's account page for an API key.' It also scopes who this is for ('clients that connect with an API key rather than OAuth'), which cleanly separates it from every read-only analyst sibling.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly gives the condition for use ('For clients that connect with an API key rather than OAuth') and rules out impact on OAuth connections. It does not name an alternative tool to use instead, but for a setup/auth tool the usage context is unambiguous.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.