Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description carries real behavioral weight the annotations do not: a password is required to open a locked file, unlock requires knowing the existing password, and flatten irreversibly "burns" fields and annotations so they "can't be changed." That last point sits in tension with destructiveHint=false, though the tension is plausibly resolved by the tool emitting a new file rather than mutating the original — worth noting, not a hard contradiction. It does not say what happens on a wrong password or whether the original is preserved.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Three parallel clauses, mode name first, zero filler — the dense fragment format is front-loaded and easy to scan. It is arguably over-terse for a six-parameter tool with a nested file object, which is the only deductible point.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return values need not be explained, and the mode semantics are covered. However, with four interchangeable-looking file-source parameters and a nested file object, the description should say which source to supply and when (uploaded attachment vs. file_id vs. library_file_id vs. public URL); that routing guidance is entirely absent.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Coverage is 67%, and the description meaningfully clarifies two things the schema does not: the semantics of the operation enum, and that password means "to open the file" (lock) or "the password you already know" (unlock), which the schema leaves entirely blank. The four file-source parameters (file, file_id, file_url, library_file_id) get no mention at all, so roughly half the input surface is undescribed.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description gives a specific verb per mode (lock/unlock/flatten) against a clear resource (a PDF), and the per-mode clauses make the tool's scope unmistakable. It does not differentiate from adjacent siblings such as redact_pdf, sign_pdf, or edit_pages, which is the only thing keeping it below a 5.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

"unlock: remove a password you know" implies a prerequisite (you must already possess the password), and the three operation definitions implicitly tell the agent which mode fits which situation. But there is no explicit when-to-use/when-not framing, no mention of alternatives when a PDF is already unprotected, and no guidance on choosing between this and redact_pdf for removing content.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.