Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations only state readOnlyHint=false and openWorldHint=true. The description goes far beyond, disclosing that the old key dies instantly and exactly once, that the API key alone is refused, that the new key appears only in the reply, that retries with the same idempotency_key are refused with conflict, and that no seller-written text is in the reply. This is exemplary transparency for a security-sensitive mutation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is long but every sentence carries essential information for correct and safe usage. It is front-loaded with the core action and then details edge cases and security nuances. It could be considered dense, but for a security-critical tool, the density is justified and no sentence is wasted.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the complexity (5 parameters, nested objects, no output schema), the description covers all crucial aspects: how to authenticate via challenge, when to use profile_id, recovery key replacement, idempotency, and the reply's exclusivity. It references docs('keys') for deeper detail, ensuring an agent can call it correctly without missing critical constraints.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, but the description adds substantial meaning: it explains the challenge flow (getChallenge → sign with recovery key), the recovery_proof purpose (purpose rotate_recovery, wallet = new_recovery_pubkey), the profile_id usage for the lost-key case, and idempotency semantics. This goes well beyond the schema's basic field descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('Mint a new API key') and resource ('for your profile'), and immediately distinguishes itself from siblings by stating the old key dies instantly and the requirement for a challenge from getChallenge. This makes it unambiguous what the tool does and how it differs from, say, getChallenge or setWebhook.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

It explicitly describes when to use the tool: for rotating an API key, with or without the old key, and details the lost-key scenario using profile_id. It also mentions the idempotency key behavior, which is critical for retries. While it doesn't explicitly list alternatives, the reference to docs('keys') and the challenge flow clarifies the context of use.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.