Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations only cover safety (readOnly/openWorld/idempotent); the description adds the material behavior an agent needs: the x402 payment handshake (first call returns terms, retry with _meta["x402/payment"]), the $0.15 cost, the 3-10 s latency, and that it is non-intrusive versus the ownership-verified Deep scan. These are exactly the traits annotations cannot express for a paid, network-facing tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

One dense paragraph, front-loaded with the thing an agent most needs to know for a paid endpoint (price and payment retry mechanics), then scope, then alternatives. The check enumeration is useful but the parenthetical list is long; nearly every clause earns its place, though it could be split into shorter sentences for scanability.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Covers cost, the two-step payment flow, runtime, what is and isn't scanned, output shape (grade + top 10 findings), and escalation options. With no output schema and a trivial single-param input, nothing an agent needs to call this correctly and interpret the response is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Only one parameter (url) and the schema already documents it at 100% coverage with an example format, so the description is not required to compensate. The description adds nothing about URL handling (e.g., redirects, bare-domain normalization) that would extend the schema's meaning, so baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb+resource (passive website security scan) and enumerates the exact checks performed (headers, TLS, cookies, SPF/DKIM/DMARC, CAA, IPv6, security.txt), plus the outputs (A-F grade, top 10 findings). It distinguishes itself as the LITE tier versus the $1 Safe check and $5 Deep scan, but never differentiates from the closely related sibling security_headers, which is a subset of this scan.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Clear context for when this is the right call: passive, non-intrusive, fast (~3-10 s), cheap ($0.15), and no ownership verification needed. The upgrade path makes the when-not condition implicit (choose Safe/Deep for more depth), but it does not explicitly tell the agent when to pick security_headers or seo_audit_lite over this.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.