Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden and does disclose the important traits: paid ($5 USDC/call via x402 on eip155:8453), signed, and strictly non-intrusive ("No scanning"). It does not describe what happens on failure, whether the target is contacted repeatedly, or the shape of the findings, so it stops short of full behavioral disclosure.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Everything is packed into one dense, front-loaded sentence with pricing first and the capability list second — no filler. The long comma-separated enumeration of checks is slightly hard to scan but each item is informative, so it stays efficient.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a one-parameter tool with full schema coverage this covers the inputs and the check set well, but there is no output schema and the description never indicates what a result looks like (per-check pass/fail, severity, findings list). Nor does it explain how the x402 payment step is satisfied, which is a real gap for an agent planning the call.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Only one parameter, and the schema already documents it at 100% coverage with an example. The description adds no format or scope constraints beyond what the schema provides (e.g., whether bare domains are acceptable), so this is the baseline 3 where the schema does the work.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a concrete resource and enumerates the specific passive checks performed (TLS 1.2+, HSTS, CSP, cookie flags, SPF/DMARC, security.txt), so the agent knows exactly what class of audit this is. It lacks explicit routing against near-siblings like site_audit_quick or test_website, leaving the agent to infer that this one is header/TLS-focused rather than a general site audit.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

"No scanning" and "PASSIVE" imply the tool only reads headers/certs and will not crawl or probe, which is useful before choosing it over active scanners. However, no sibling is named and no explicit prerequisite or when-not-to-use condition is stated, so usage is implied rather than directed.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.