Kenwea Notary

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Far exceeds what annotations provide (readOnly/openWorld/idempotent=false): it discloses the sandbox profile (no route out, all capabilities dropped, read-only FS, non-root, 15s/55s limits), the 32 MiB cap, decoy credentials planted, what each verdict/reasonCode means, caching behavior, in-memory retention, and address hashing. No annotation is contradicted — running code in a sealed sandbox is consistent with readOnlyHint=true and destructiveHint=false.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

It is front-loaded (purpose in sentence one) and uses scannable labels (Input, Behavior, Returns, Limits, Not for). However, it is roughly 700 words of dense prose for a two-parameter tool, with detail (TLS recorded by server name and size, PyPI sha256 checks) that an agent selecting or calling the tool does not need. Structure is good, density is excessive.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

No output schema exists, and the description compensates fully: it enumerates the return fields (level, summary, installSteps, observed, sincePrevious, verdict, reasonCode, sha256, signedAttestation) and defines each verdict word and reasonCode. For a complex, high-stakes analysis tool, an agent has everything needed to invoke it and interpret the result.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3, but the description adds real semantic value the schema does not: version resolution rules (no version means latest, PyPI resolved to a musllinux wheel for CPython 3.12, ClawHub releases gated on a published SHA-256), and the one-of constraint between the two parameters. It stops short of 5 only because much of the input detail is restated from the schema descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The opening sentence gives a specific verb and resource (notarize what a file or npm package does at fetch time) and names the exact output artifact (a signed record anyone can check). It also explicitly differentiates from a sibling: 'Not for: checking a record you already have (use kenwea_notary_verify...)'. An agent can distinguish this from verify without opening either schema, even though kenwea_notary_check_tree is left unaddressed.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicit mutual exclusivity ('exactly one of artifactRef... or package'), an explicit when-not with the alternative named (kenwea_notary_verify), and operational guidance (retry on runner_busy, rate_limited with reset time). It stops short of 5 because the sibling kenwea_notary_check_tree, clearly the nearest alternative for tree-shaped artifacts, is never mentioned or contrasted.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations declare readOnly/idempotent/non-destructive/openWorld, and the description adds substantial context beyond them: nothing executes during the call, it does not consume the per-address check quota, throttling of ~2 background checks/minute, the 60 tree calls/hour limit, and the requirement to verify each record separately.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Dense but well-structured with explicit Input/Behavior/Returns/Not-for sections, and the need-to-know constraints (no execution, no quota spend) are front-loaded. It is long relative to most definitions, though nearly every sentence carries actionable information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Despite having no output schema, the description enumerates return fields (summary, counts, findings, packages with status/level/verdict/observed/signedAttestation), so an agent knows the response shape, plus limits and verification steps. Nothing needed to invoke or interpret it is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the schema already documents both parameters, but the description adds meaning beyond it — accepted lockfile formats and versions, the alternative `packages` shape, and how hasInstallScript (or pnpm requiresBuild) drives whether a package is answered or merely counted.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and domain (answer for every package in an npm dependency tree from notary records) and explicitly contrasts with the sibling kenwea_notary_check ("Not for: one package you want checked now"). An agent can select it against alternatives without opening a schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives explicit when-to-use (whole tree at once), when-not (single package, use kenwea_notary_check), and a concrete failure condition (lockfileVersion 1 is refused). It also tells the agent to re-ask later with the same tree to collect queued results.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already cover the safety profile (readOnlyHint, openWorldHint=false, idempotentHint, destructiveHint=false), but the description adds real operational context: it fetches a specific well-known URL, caches for an hour, runs nothing, never counts against the check quota, and fails with the named error key_unavailable. That is exactly the beyond-annotations detail the bar asks for.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with the purpose, then cleanly sectioned into Input / Behavior / Returns / Not for. It is dense but every clause carries non-redundant information — caching, quota, error name, verification recipe — with no filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

No output schema exists, so the description carries the burden and does: it enumerates the returned fields (keyId, algorithm, base64, PEM, keyUrl, keysUrl, keys with status) and even explains how to use them to verify a signature. For a zero-param read-only tool with annotations covering safety, nothing needed to call it correctly is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Zero parameters, which sets the baseline at 4. The description states 'Input: none,' which correctly sets expectations that no arguments are needed, but there is nothing further to disambiguate since no parameters exist.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource — 'Return Kenwea's published Ed25519 notary key' — and immediately distinguishes it from siblings with 'Not for: checking an artifact (use kenwea_notary_check) or having the check done for you (use kenwea_notary_verify).' An agent can select this over its three siblings without opening any schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives an explicit when-to-use ('so a signed record can be verified with your own code instead of kenwea_notary_verify') and explicit exclusions naming the two competing siblings with the alternative action each performs. Nothing is left to inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Although annotations already declare readOnlyHint, idempotentHint and destructiveHint=false, the description adds substantial non-redundant behaviour: a single outbound fetch to a named URL cached for one hour, quota semantics (never counts against the check quota), revoked-key handling returning valid=false, malformed input returning valid=false with a reason rather than an error, and the key_unavailable failure mode. This is exactly the kind of operational detail annotations cannot express.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The prose is organised into labelled Input / Behavior / Returns / Not for blocks with the purpose front-loaded, so an agent can scan to the section it needs. It is long, and a few phrases (e.g. 'so it was shown to everyone and not only to you') could be trimmed, but the density is justified by the tool's complexity rather than padding.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a non-trivial verification tool with no output schema, the description fully covers inputs, network/auth behaviour, the returned fields (valid, keyId, status, signed facts, matchesContentSha256) and the error cases. Nothing an agent needs in order to call this correctly is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline would be 3, but the description materially exceeds it: it warns that payload must be passed byte for byte and that re-serialising (key reordering, spacing) breaks the signature, specifies signature is standard base64 with padding, and states contentSha256 is compared case-insensitively. These are invocation-critical constraints absent from the schema text.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The opening sentence states a specific verb and resource (verify a signed record produced by kenwea_notary_check) and enumerates the three things it determines: signature validity, attestation content, and transparency-log inclusion. It explicitly distinguishes itself from siblings via the 'Not for' clause naming kenwea_notary_check for artifact behaviour and kenwea_notary_get_public_key for manual verification.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives an explicit precondition (a record produced by kenwea_notary_check), an explicit exclusion ('Not for: learning what an artifact does'), and a named alternative workflow with concrete steps for verifying without the tool. When-to-use and when-not-to-use are both covered with no inference required.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.