Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnly, idempotent, openWorld, non-destructive, so the safety profile is covered. The description adds genuinely non-obvious behavior: two of the seven controls cannot be observed from a DNS scan, so results cap at INDETERMINATE, and unmet-observable controls report NOT MEASURED rather than a pass. It does not mention caching behavior, though the force_refresh parameter implies it.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with the core question, then the control list, then the INDETERMINATE caveat, then the sibling differentiation. Every sentence carries distinct information and the caveat is placed before the alternative, which is the right priority order.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

No output schema exists, yet the description specifies the verdict vocabulary (satisfied / not satisfied / NOT MEASURED / INDETERMINATE) and that structured evidence accompanies each verdict, which is exactly what an agent needs to parse results. Combined with the control enumeration, nothing material is missing for a 3-parameter read-only tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% with all three parameters documented (domain, format, force_refresh), so the description need not restate them. It adds no parameter-level detail beyond the schema; 'one domain' and 'DNS-only scan' are the only implicit hints. Baseline 3 is correct.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (answer whether), a resource (one domain's SGE compliance), and a concrete deadline-bound standard (NZ SGE, October 2026). It also enumerates the seven controls checked, so an agent knows exactly what output dimensions to expect and can distinguish this from single-check siblings like check_dmarc or check_spf.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly scopes usage to ONE domain and names the alternative (map_compliance) plus the reason to pick that alternative (NIST/PCI/SOC 2/CIS mapping). The 'DNS-only result tops out at INDETERMINATE' note tells the agent what this tool cannot do, which is unusually good exclusion guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.