Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden. It does disclose a real operational constraint, the access key requirement (free uses or credits, pointing to POST /crear-llave), and explains its detection heuristic. It says nothing about whether the call is read-only/idempotent or what the result looks like (findings list, risk score, verdict), which leaves the agent guessing on output behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The core criteria are front-loaded, but the whole definition is one run-on sentence with nested parentheticals and dashes, and roughly a third of it is a narrative about the October 2026 Binance hack (6.3 billion dollars, TRM Labs attribution). That anecdote motivates the tool but does not help an agent decide whether to invoke it, and it buries the actionable criteria.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Input requirements, detection scope and the auth prerequisite are covered, and there is no output schema to compensate for. However, for a scanner with no annotations and no output schema, the description never indicates what is returned (per-tool findings, severity, pass/fail), which is the main missing piece for correct downstream use.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Only one parameter and the schema already documents it at 100% coverage, so the baseline is 3. The description adds value by naming the expected payload as a MANIFIESTO in the same format as audit_mcp_server, and the schema itself notes it may be a full object or a bare tools array, giving the agent confidence about reuse between scanners.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource (analyze an MCP server's manifest) plus the exact defect class it looks for: a high-value/irreversible tool name or description with no required confirmation field and no maximum/exclusiveMaximum on an amount field. It explicitly positions itself against audit_mcp_server and detect_toxic_flow_risk, so an agent can separate it from the many other detect_* scanners without opening schemas.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives a clear applicability condition (excessive agency, OWASP LLM06, in a tool's input schema) and an explicit non-mitigation rule — a separate 'request approval' tool does not count — which is genuinely useful routing logic. It does not state when NOT to run it (e.g., when the manifest is truncated or when another scan already covers the same finding), so it stops short of full when/when-not guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.