FillTrust security questionnaire corpus

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

There are no annotations, so the description carries the behavioral disclosure burden. It adds a useful detail by noting that the response 'Includes the answers that are no,' which clarifies the output scope. However, it does not mention whether the operation is read-only, requires authentication, or has any other behavioral caveats.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise and front-loaded with the core purpose. The phrase 'questions it exists to answer' is slightly indirect, but the meaning is understandable and the additional note about 'no' answers is valuable without being verbose.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a zero-parameter, read-style tool with no output schema, the description gives enough context about the resource and intended use. It could mention response format or size, but the tool's simplicity makes the current description reasonably complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool takes zero parameters and schema description coverage is 100%, so the schema already exhaustively documents the input surface. The description adds nothing about parameters, but none is needed; the baseline of 4 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly defines the resource as FillTrust's own security posture answers, with a specific audience ('anyone assessing it as a vendor'). The title reinforces the read action, and the description distinguishes this from sibling tools that inspect questions or standards rather than FillTrust's own responses.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides clear context for when to use this tool: when assessing FillTrust as a vendor and wanting its own self-reported posture. It does not explicitly mention alternatives or exclusions relative to get_question, search_questions, or list_standards, so it stops short of full routing guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the behavioral disclosure burden. It clearly indicates a read operation via the title 'Read' and the tool name 'get', and it richly describes what the response includes: the real question intent, relevant documents, evidence requirements, model answer, common pitfalls, and associated standards. It does not mention auth or edge cases, but for a simple read-only lookup the disclosure is strong.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is one long but well-structured sentence with a colon-led list of contents. It front-loads the core purpose and every listed item adds information about the returned guidance, so there is little waste. The length is justified but slightly dense for quick scanning.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool has a single parameter, no output schema, and no annotations, so the description is the primary source of completeness. It thoroughly describes the return value's contents, including model answers, common mistakes, and standard references, which is enough for an agent to know what it will get and how to use the result.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 100% description coverage for the single 'slug' parameter, so the schema already explains that the value comes from a search_questions result. The tool description adds no parameter-specific detail beyond saying it is 'for one questionnaire question,' which is adequate but does not improve on the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly identifies the tool as retrieving the complete published guidance for a single questionnaire question, then enumerates exactly what that guidance includes. This distinguishes it from search_questions, which would be used to discover questions rather than read full guidance.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies this is the follow-up tool to use after finding a question slug via search_questions, and the schema reinforces that by requiring a slug from search_questions. However, the description itself never explicitly states when to use this versus a sibling tool or when not to use it.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure, and it delivers key transparency by stating 'These are counts from real files rather than an estimate.' It also clarifies the data source (146 real vendor questionnaires) and implies a read-only stats operation. It does not detail edge-case behavior (e.g., unknown questionnaire names), but the provided context is solid.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is efficiently written: the first sentence packs the resource and output kinds, the second gives direct usage guidance, and the third adds provenance. Every sentence earns its place, and the most decision-relevant information is front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple tool with one optional parameter and no output schema, the description adequately explains what the tool returns (topic counts and named questionnaire profiles) and when to use it. It could be more complete about the exact output structure or behavior with unknown named questionnaires, but the agent has enough to select and invoke the tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema already documents the single optional parameter at 100% coverage, including examples and the omit-for-corpus-wide behavior, so the baseline of 3 applies. The description reinforces this by mentioning HECVAT and CAIQ and the distinction between topic counts and named profiles, but adds no new syntax or format details beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific subject ('security questionnaires') and measurable outputs ('which topics are asked most' and 'detailed profiles'), clearly distinguishing what this tool provides. The mention of HECVAT and CAIQ and the explicit use-case sentence ('Use this when asked what a security questionnaire contains, how long one is, or what a named questionnaire asks about') make the purpose unmistakable and differentiate it from the sibling tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives clear context for when to invoke this tool ('Use this when asked...') and explains how to retrieve either corpus-wide counts or a named profile. However, it does not explicitly state when not to use it or compare it to alternatives like search_questions or get_question, so it falls short of a full 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full disclosure burden. It does well by explicitly stating that standards with proprietary control lists are named without reference numbers, and that this is intentional. This is a meaningful behavioral caveat beyond the basic list semantics, though it does not describe every possible edge behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two tight sentences with no filler. The first sentence front-loads the main deliverables, and the second adds an important caveat about proprietary control lists. Every sentence earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a zero-parameter, no-output-schema tool, the description is complete: it states what is listed, what counts are included, what related data is cited, and the one intentional omission. An agent has enough information to select and invoke this tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters and the schema is an empty object with 100% coverage, so there are no parameter semantics to clarify. The description adds useful context about the returned information, which is more than needed for a parameterless tool.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a specific verb and resource: it lists the questionnaire standards a corpus covers, including question counts and cited controls. This content is clearly distinct from sibling tools like get_question or search_questions, which focus on individual questions or statistics rather than standards coverage.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The intended use is implied: an agent should call this when it needs an overview of which standards the corpus addresses and how questions/controls map to them. However, there is no explicit when-to-use guidance, no exclusions, and no references to alternatives such as get_questionnaire_statistics for other summary needs.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description independently discloses that the tool is a search operation and returns matching entries with the URL of each source page. It does not state matching behavior, ranking, or absence of side effects, but for a read-only search tool the core behavioral expectations are reasonably covered.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Three sentences with no filler. The main purpose is front-loaded, search dimensions follow, and the return format is stated. Every sentence contributes necessary information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple two-parameter search tool with no output schema and no annotations, the description covers the key invocation context: what to search by, what the results contain, and the source URL. Minor omissions like sorting or no-results behavior are not critical for selecting and invoking the tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3. The description adds value by explaining that the query can be a question text, control area, or standard/control identifier, and gives a concrete CEK-03 example, which meaningfully enriches the query parameter semantics beyond the schema's description.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description starts with a specific action ('Find guidance') tied to a well-defined resource ('security questionnaire question' / questionnaire corpus). It gives concrete search dimensions (question text, control area, standard/control identifier) and clearly differentiates from siblings like get_question by focusing on searching rather than fetching a single record.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description clearly implies when to use this tool: when you need guidance on answering a security questionnaire question and have text, control area, or an identifier. It does not explicitly exclude alternatives or mention get_question when a specific ID is known, but the intended use context is clear enough.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.