Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnly/idempotent/non-destructive, so the description only needs to add nuance. It does add that the scan targets a public website and returns a score with fixes, but it does not disclose methodology, rate limits, or other behavioral details. This is similar to the get_calls calibration, where annotations cover safety and the description adds limited context.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence that front-loads the action (scan), the target (public website), the specific focus (TLS/header weaknesses), and the outcome (score with fixes). There is no redundant or unnecessary wording.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the simplicity of the tool (one parameter, output schema present), the description covers the core aspects: purpose, target, checks, and result. The 'public website' qualifier is a useful constraint. It does not need to describe return values in detail because the output schema exists.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema has 0% description coverage for the single 'url' parameter. The description implicitly tells the agent the URL must be for a public website, which adds some semantic value beyond the schema's URI format, but it does not explicitly explain the parameter's role or format beyond what the parameter name and schema imply.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool scans a public website for TLS and browser security header weaknesses, with an explicit outcome of a security score and fixes. It distinguishes itself from sibling audit tools like web.seo-audit or web.performance-profile by focusing specifically on security headers and TLS.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies when to use the tool by specifying the exact security scope, making it clear this is for TLS/header security audits. However, it does not explicitly mention alternatives or when not to use it, so it lacks the explicit comparison seen in top-tier descriptions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.