Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full load, and it does disclose the two things an agent most needs: the return shape ('findings with line, why, fix and a score') and the commercial/auth model ('$0.01 USDC per call, paid with x402 on Base'). It stops short of stating error behavior, whether a score of zero is a pass, or any rate/limit constraints.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Verb and resource are front-loaded, the rule catalog is compressed into one clause, and the return and price statements follow immediately. The rule list is dense but every item is a real differentiator rather than filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no annotations and no output schema, the description must explain both behavior and returns, and it does name the finding fields and the score. Remaining gaps are minor: score range, determinism, and failure modes for malformed or oversized content are unstated.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

There is a single parameter and schema description coverage is 100%, with 'Full text of the file (max 100 KB)' already documented. The description adds no syntax, format, or edge-case guidance beyond implying the file is a Dockerfile, so the baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

Names a specific verb and resource ('Lint a Dockerfile') and then enumerates the exact rule families checked (base image pinning, root user, curl|sh, remote ADD, secrets, apt/pip/npm hygiene, chmod 777, EXPOSE 22, HEALTHCHECK, layer order). That rule set makes it unambiguously distinct from ciaudit_compose and ciaudit_github_actions without the agent opening either schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The usage is implied by the resource ('Lint a Dockerfile'), but there is no explicit when-to-use/when-not statement and no routing to the sibling linters ciaudit_compose or ciaudit_github_actions, which an agent auditing a repo would plausibly confuse it with.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.