Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnly, idempotent, non-destructive, closed-world behavior, but the description adds security-critical context the annotations cannot convey: server environment secrets are never used, and the signing secret must come from the caller. It also discloses that affiliateJoin carries a permission prerequisite.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Four tight sentences with no filler; the core computation and the secret-source constraint are front-loaded. The affiliateJoin sentence feels slightly bolted on but still carries useful information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return values need not be explained. The description covers the secret-handling model and the one side-effect-ish parameter, which is most of what an agent needs; only the 'email' input lacks any explanation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description carries the full documentation burden. It explains participantAuthSecret (caller-supplied, test vs. production usage) and affiliateJoin (requires program-join permission), but the required 'email' parameter is never described or exemplified, leaving one of three parameters undocumented.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a precise verb and resource ('Compute a SHA-256 HMAC') and immediately scopes it with 'using the caller-supplied participantAuthSecret'. No sibling tool performs hashing, so this is trivially distinguishable from the rest of the toolset.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives concrete guidance on how to use the tool in practice ('Use a test secret during implementation; keep production signing in your backend') and flags a conditional requirement for affiliateJoin. It does not name an alternative tool, but no plausible alternative exists in the sibling list.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.