verify_recordIndependently verify the ECDSA (ES256) signature on a LaunchTrust signed scan/disclosure record against the published public key. Pass the record JSON (the downloaded record, or an object containing canonical and signature).
| Name | Required | Description | Default |
|---|---|---|---|
| record | Yes | The LaunchTrust signed record JSON (or an object with `canonical` + `signature`). |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, idempotentHint, openWorldHint. The description adds that it verifies against the 'published public key' and specifies the expected input structure, providing context beyond annotations without contradiction.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Exactly two sentences, minimal and effective. First sentence gives purpose, second gives usage. No wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Missing crucial information about what the output/return value is (e.g., boolean, status, error). Since there is no output schema, the description should indicate verification result format. Also does not mention potential errors (e.g., signature mismatch, invalid public key). Incomplete for a verification tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% and schema description already details the 'record' parameter as 'The LaunchTrust signed record JSON...'. The description essentially repeats the same info, adding no new meaning. Baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'verify the ECDSA (ES256) signature on a LaunchTrust signed scan/disclosure record', specifying verb, resource, and algorithm. It distinguishes from sibling tools which are about listing, scanning, or registering, not verification.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description says 'Pass the record JSON' and gives shape, which implies when to use: when you have a record to verify. But it does not explicitly state when not to use it (e.g., if you need to retrieve a record first) or name alternatives like get_scan_history. Usage context is implied but not thorough.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Add one secure layer between your agents and this server.
Each tool has a clearly distinct purpose: retrieving rules vs jurisdictions vs scan results vs triggering scans vs verification. No overlap in functionality.
All tool names follow a consistent verb_noun (snake_case) pattern: get_, list_, register_, scan_, verify_. Conventions are uniform throughout.
9 tools cover the essential operations for compliance scanning: registration, scanning (full and quick), results retrieval, history, and verification. The scope feels well-calibrated.
Core CRUD-like coverage is present: register, scan, read results, verify. Missing update/delete for apps or scans is a minor gap but not critical for the domain's primary workflow.