Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations only declare readOnly/idempotent/closed-world, so the description carries the interesting load and does so: it discloses the return vocabulary (allow/warn/block), the findings, the redacted copy, an on-chain-anchored Ed25519 receipt, the non-storage guarantee, and the pricing model (free 1,000/month with org key, else 1 cent USDC via x402). These are concrete behavioral traits an agent can't derive from the annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loads the purpose in the first sentence, then the return contract, then the trust/privacy and pricing facts, with no filler sentences. The one-sentence pricing/x402 tail is dense but still earns its place for a paid tool.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description fully compensates by explaining the return values (allow/warn/block, findings, redacted copy, signed receipt). Combined with the parameter docs and annotation-covered safety profile, an agent has everything needed to call this correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, and the enum for direction plus the source label are fully documented in the schema, so a baseline of 3 applies. The description reinforces the inbound/outbound semantics but adds no syntax, format, or constraint detail beyond what the schema already states.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Check content for prompt injection ... or leaked secrets and personal data') and adds the preconditions 'before an agent acts on it or sends it'. It does not name its closest sibling guard_check_many (the batch variant), so the boundary with that sibling is left to inference, but the core purpose is unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives clear usage context via the inbound/outbound framing: check untrusted content coming in before acting on it, check content going out before sending it. No explicit when-not or alternative-tool routing (e.g. use guard_check_many for multiple texts, or guard_receipt to fetch a receipt later), so it stops short of a 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.