score_domainProfile a domain: registration date from RDAP, registrar, MX/SPF/DMARC configuration, disposable-mail and risky-TLD detection. newly_registered is null when the age genuinely could not be determined — treat that as unknown, not as 'established'.
| Name | Required | Description | Default |
|---|---|---|---|
| domain | Yes | Bare domain, e.g. example.com |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It does well by listing what data sources and checks are performed, and it explicitly clarifies the null semantics for 'newly_registered' to prevent misinterpretation. It doesn't mention output format or side-effect absence, but 'Profile' implies a read-only analysis, and the disclosed caveat is valuable.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is compact and front-loaded, with two sentences that each earn their place. The first lists the tool's core capabilities, and the second provides a necessary edge-case clarification without any filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool has one parameter, no output schema, and no annotations, so the description must explain return behavior. It lists specific checks and the null caveat, but it never describes the actual output structure, score range, or how to interpret the domain risk score. This leaves a notable gap for an agent trying to use the result downstream.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema already fully describes the only parameter ('domain') with a clear example. The description adds no extra parameter details, but since schema coverage is 100%, the baseline of 3 is appropriate; the description does not need to compensate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Profile') with a clear resource ('a domain') and enumerates concrete data points (RDAP registration date, registrar, MX/SPF/DMARC, disposable-mail, risky-TLD). This clearly distinguishes it from sibling tools that target other entities like devices, IPs, or users.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description makes the context obvious: use this tool to profile a domain's configuration and risk indicators. It doesn't explicitly state when not to use it or name alternatives, but the sibling list and the domain-specific focus provide enough context for an agent to select it appropriately.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Add one secure layer between your agents and this server.
Each tool targets a distinct resource or action: phone, device, domain, IP, user (aggregate), agent, and email. The descriptions clearly separate individual signal scoring from the combined user scoring, and cryptographic verification is uniquely assigned to verify_agent. No two tools overlap in purpose.
Most tools follow the score_<object> pattern (score_device, score_domain, score_ip, score_user), but lookup_phone and verify_email/verify_agent deviate by using different verbs. The naming is still readable and logically grouped, though a more consistent prefix like score_phone and score_email would improve uniformity.
Seven tools cover the core signals for signup risk assessment without unnecessary redundancy. Each tool serves a clear purpose, and the count is well within the typical 3-15 range for a focused API.
The set covers the primary data points used in fraud/risk evaluation: phone, IP, email, domain, device, and a combined user score, plus a cryptographic agent verification for advanced scenarios. There are no obvious dead ends or missing lifecycle operations for this read-oriented risk assessment domain.