Moltline Agent Governance & MCP Auditor

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Adds substantial context beyond the annotations: it discloses that the tool fetches live public URLs over the network, specifies that it never raises a protocol error and instead returns a structured {"error": ...} object, and states retry safety after correcting input. This is exactly the behavioral disclosure annotations alone cannot carry, though the network-fetching claim sits in mild tension with openWorldHint=false.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with purpose, then when-to-use, then exclusions and error behavior — a sensible order with no filler sentences. It is slightly dense with inline JSON blobs, but each block conveys call shape or failure handling rather than repeating structured fields.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Covers purpose, selection criteria, network/auth-relevant behavior, error semantics, and retry guidance for a single-parameter tool. Although an output schema exists, the inline example of score/grade/failed/report_url clarifies the shape of the result at a glance.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With a single parameter at 100% schema coverage, the schema already documents the input fully. The description still adds value by showing a typical call ({"domain": "example.com"}) and tying the error contract to input validity, which reduces formatting mistakes.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Score a public domain against 21 agent-readiness checks') with an explicit scope and output contract, then names the two sibling tools it is not (audit_mcp_config, injection_scan). An agent can distinguish it from every sibling without opening a schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives a concrete when-to-use trigger ('whether an autonomous agent can discover, read, use or pay a website') with two real scenarios, and explicit when-not clauses that route to the correct alternatives by name. Nothing is left to inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint, idempotentHint and destructiveHint=false, but the description adds genuinely new behavior: it never echoes matched secret values, it never raises a protocol error on bad input and instead returns an {"error": ...} object, and retry after correction is safe. That non-disclosure guarantee and error contract are exactly what an agent needs and are not derivable from the annotations; only return-value enumeration overlaps with the existing output schema.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The purpose and detection list are front-loaded, and each later sentence carries distinct information (non-disclosure, error contract, sibling routing). Slight bloat from the redundant inline return-value enumeration and the stray 'FREE.' marker keeps it off a 5.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a one-parameter read-only audit tool, the definition covers purpose, detection scope, secret-handling guarantees, error behavior, retry safety, and sibling disambiguation. Return values are already covered by the output schema, so the inline restatement is redundant but not a gap.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% and the single parameter already documents the accepted formats (mcpize.yaml, mcp.json, Claude/Cursor servers block). The description's 'Typical input' example restates those formats and the example return shape rather than adding syntax or edge-case rules, so the baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Audit an MCP server config') plus the output nature ('risk-ranked posture findings') and enumerates exactly what it detects. It explicitly names the siblings it is not: audit_skill_file and injection_scan, so an agent can route without opening any schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

'Use on a server configuration document' sets the positive case, and the two explicit exclusions route skill files to audit_skill_file and untrusted content to injection_scan. No alternatives are left to inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint, idempotentHint, destructiveHint=false and openWorldHint=false, and the description partly restates that ('read-only and idempotent'). The genuine added value is the error contract: it never raises a protocol error and instead returns an error object describing the fix, which makes retry-after-correction safe. That is real behavior the annotations cannot express; the mild repetition of the safety hints keeps it from a 5.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Purpose and exclusions are front-loaded and well ordered, but the block is longer than needed: the return-shape example duplicates an existing output schema, and 'FREE' plus the retry sentence add bulk around an otherwise tight core. Structure is good; economy is only fair.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With an output schema present, the description need not explain return values, and annotations already cover the safety profile. What remains — scope, the sibling boundary, the input expectation, and the non-throwing error contract — is fully stated, so an agent can call this correctly on the first attempt.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

There is a single required parameter with 100% schema description coverage ('Full text of the skill file, system prompt, or tool description to audit'), so the schema already carries the semantics. The description's inline example echoes the same content without adding format, size, or truncation guidance, so baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

Opens with a specific verb and resource ('Audit an agent skill or instruction file') and immediately enumerates the concrete failure classes it detects: prompt-injection, guardrail-bypass phrasing, concealment instructions, exfiltration language, exposed credentials. It also names the sibling it is not (injection_scan), so the tool is distinguishable without opening any schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives an explicit trigger ('before trusting a skill or instruction file that came from outside your own repository') and an explicit exclusion with the correct alternative ('Not for arbitrary untrusted input at run time (injection_scan)'). The when/when-not/alternative triad is fully covered.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already cover read-only, idempotent, closed-world and non-destructive, and the description does not merely restate them — it adds the PREMIUM license requirement, the zero-argument nature, the exact return shape, and a non-obvious error contract (never raises a protocol error; returns an error object with remediation). That error/retry guarantee is information the agent cannot get from the annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Purpose and the sibling exclusion are front-loaded and the whole thing is short. Minor waste: the return-shape sketch duplicates the output schema, and the error-handling paragraph is boilerplate for a tool that accepts no input at all.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a zero-arg read tool with an output schema, licensing, purpose, exclusion, return keys, idempotency and error behavior are all covered. Nothing an agent needs before calling is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Zero parameters, so the baseline is 4; the description reinforces this with 'Takes no arguments' and documents the returned keys. It adds nothing more to document, but the explicit statement removes any doubt about whether arguments are needed.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Load the Governance Auditor persona') plus the reason ('for consistent fleet audits'), and explicitly distinguishes itself from the audit-execution siblings with 'Not for running an audit - the audit tools do that.' An agent can route between this and audit_mcp_config/audit_skill_file/scope_check without opening a schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives both the positive case ('Use to keep repeated audits consistent in voice and rigor') and the exclusion ('Not for running an audit'). It also flags the licensing gate, which is a real precondition for calling it.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnly/idempotent/non-destructive/closed-world, but the description adds material facts the annotations cannot express: a PREMIUM license gate, and the error contract (never raises a protocol error, instead returns {"error": "..."} with remediation guidance, and is safe to retry after fixing input). That is exactly the kind of context an agent needs before committing to the call.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with purpose, then coverage, then an inline example, then usage and error semantics. It is dense but every sentence carries a fact; the embedded JSON examples are compact enough not to bloat it.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

A single-optional-param generation tool with an output schema, full schema coverage, and annotations; the description additionally previews the return keys and the error path. An agent has everything needed to decide and call correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% and the single parameter is already well documented as an optional free-text fleet description, so the baseline is 3. The description adds value with a concrete input example ('20 agents, 3 with shell access, one finance bot') that shows the expected granularity and shape of that string.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and artifact: 'Generate an audit-ready agent-governance policy for a fleet', and enumerates the six domains the policy covers. It is clearly separable from the sibling assessment tools it names.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

'Use when a fleet needs a written policy document' gives the positive trigger, and 'Not for assessing what the fleet currently does (inventory_report, audit_mcp_config)' gives an explicit exclusion plus the two alternatives to route to. Nothing is left to inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the annotations, it discloses the key caveat that a clean result is not a guarantee of safety and that only pattern matches are reported, and it documents error behavior in detail (never raises a protocol error, returns an error object with remediation). The read-only/idempotent restatement is redundant with the annotations but the remaining content is substantive and non-obvious.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Purpose and scope are front-loaded in the first sentence, followed by usage, an inline example, exclusions, and error contract. Dense but nearly every clause earns its place; the 'FREE.' token and the inline return-shape block are slightly less essential, especially since an output schema exists.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Covers purpose, exclusions, caveats, error handling, and retry safety, which is more than enough for a one-parameter tool. The inline description of the return object duplicates the existing output schema, so it is redundant rather than missing, but nothing an agent needs to call it correctly is absent.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% and the single parameter is already documented, so the baseline is 3. The description adds a concrete call example ({'text': '<untrusted content>'}) that clarifies the expected packaging of the input as a single pasted string, which is marginal but real added value.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource (scan untrusted text for prompt-injection patterns) plus the timing constraint (before ingestion). It explicitly names the sibling it is not (audit_skill_file) and scopes itself to web pages, emails, and documents, so an agent can separate it from audit tools without opening a schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives a clear when-to-use ('on any web page, email, or document an agent is about to ingest') and an explicit when-not ('not for reviewing a skill file you control — use audit_skill_file'). The alternative and the condition that selects it are both named.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the annotations, it discloses a non-obvious error contract: no protocol error is ever raised, instead an {"error": ...} object is returned, and retry is safe after fixing input. That is genuinely additive. It restates read-only/idempotent which the annotations already cover, so it earns strong but not top marks.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with the purpose, then input/output shape, then usage boundary, then error semantics — a sensible ordering with no filler. The inline sample return payload is somewhat verbose given a dedicated output schema already exists, which costs a point.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a one-parameter, read-only, non-open-world tool with annotations and an output schema, the description covers decision context, error behavior, and input format. The return-value enumeration is largely redundant with the output schema, so it is complete if slightly misallocated.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3, but the description adds a concrete worked input example ({"items": "[{\"name\": \"deploy-bot\", \"owner\": \"ana\"}]"}) that clarifies the unusual string-encoded-JSON shape the bare schema leaves ambiguous. Useful disambiguation of an awkward parameter format.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource: "Build a governance inventory with risk tiers from a raw agent list," and immediately explains what the transformation produces (tiers, unowned flags). It explicitly differentiates from siblings by naming audit_mcp_config and scope_check as the wrong choice for single-agent depth audits.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

"Use to turn a raw agent list into risk tiers. Not for auditing any single agent in depth (audit_mcp_config, scope_check)" gives both the selection condition and the exclusion with named alternatives. An agent can route fleet-level vs single-agent work without opening any sibling schema.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnly, idempotent, non-destructive, and closed-world, but the description adds genuinely new behavior: it never raises a protocol error, it returns an {"error": "..."} object on malformed input, and retry is safe after correction. Some clauses restate the idempotency/read-only hints, which keeps this just short of a 5.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The purpose and the sibling exclusion are front-loaded, and the error/retry contract is grouped at the end. The risk-ordering formula and full sample-output block are dense but each sentence carries actionable information; only minor trim would help.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a one-parameter, read-only scoring tool with a full annotation set and an output schema, the description covers purpose, alternatives, input shape, failure mode, and retry safety. Nothing an agent needs in order to select or call it is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% and already enumerates the accepted manifest formats, so the baseline is 3. The concrete example ({"tools": "[\"run_shell\", \"read_docs\"]"}) usefully disambiguates the string-wrapped-JSON quirk of the single parameter, adding a bit of value beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource: "Score the blast radius of every tool in a permission manifest," and names the capability-risk ranking it produces. It explicitly distinguishes itself from the closest sibling by saying it is "Not for the configuration that mounts them (audit_mcp_config)."

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives the trigger ("Use on a permission manifest to rank tools by blast radius") and the exclusion with a named alternative ("Not for the configuration that mounts them (audit_mcp_config)"). An agent can route between scope_check and audit_mcp_config without opening either schema.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.