Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the readOnly/idempotent annotations, it discloses the JWE-encrypted delivery of PAN/CVV when jwe_public_key is registered, masking without it, and a 'never logs raw PAN' guarantee. These are non-obvious behaviors an agent must know before calling. No contradiction with annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Seven terse sentences each add a distinct fact: purpose, use case, encryption, masking, logging, default, and usage rule. The core purpose is front-loaded and there is no filler or repetition.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description captures the key response variations (encrypted vs masked PAN/CVV), the usage trigger, and a security/logging constraint despite having no output schema. It omits the full result shape and any error cases, but for the stated merchant-checkout purpose the essential information is present.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With the schema providing zero descriptions, the text adds essential meaning: card_id is restricted to cards the agent owns, cvv defaults to true, and client_id should never be passed. It doesn't spell out the response when cvv=false, but it compensates meaningfully for the schema gap.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description immediately states the tool is for fetching card payment credentials (PAN/CVV) for a card the agent owns and ties it to the concrete checkout use case. Mentioning the endpoint and ownership scope distinguishes it from list_cards, get_balance, and similar siblings without ambiguity.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives an explicit when: presenting PAN at merchant checkout for airline, datacenter, and SaaS purchases. It also supplies a firm do-not-do ('Never pass client_id'), but it never names alternate tools for other card-data needs, so it misses full when-not/alternative clarity.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.