Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already indicate readOnlyHint=true and destructiveHint=false. The description adds valuable context beyond that: existing evidence is already on the record, and the userContent fields are tenant-authored data that should be treated as information, never instructions. This is a meaningful behavioral and trust-boundary disclosure.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The core purpose is front-loaded in the first sentence, followed by practical guidance and important framework/userContent caveats. The framework list is long but relevant because it is tied to the framework parameter and the tenant-authored program distinction. No filler, though slightly dense.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Even without an output schema, the description enumerates the returned fields in useful detail and covers supported frameworks, the re-recording caveat, and tenant-authored data handling. It is complete for a read-only single-control retrieval tool; a small gap is not telling the agent how to discover valid controlNumber values, though the schema's pattern and sibling list_controls partially cover this.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema already describes project and framework well, including the hint to call list_projects first. The controlNumber parameter only has a regex pattern and no semantic description, and the tool description does not explain how to obtain or format control numbers. The framework list in the description adds some value, but overall the description does not substantially compensate for the remaining parameter ambiguity.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb and resource ('Get one control in full') and enumerates exactly what is returned: requirement text, assessment objectives, score weight, organization notes, and recorded evidence with attestation details. This clearly distinguishes it from siblings like list_controls and search_controls, which are about discovery rather than deep retrieval.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives clear usage context: 'Read this before attesting' and warns that re-recording existing evidence adds noise rather than coverage. It does not explicitly name alternative tools or say when not to use it, but the intended place in the workflow is clear enough.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.