Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare non-read-only, non-destructive, non-idempotent, closed-world, so the bar is lower; the description still adds real context. 'Applied to the running auth service' signals live, immediate effect, and the required role plus 'auth:write' scope disclose the authorization gate that annotations do not cover. It stops short of saying whether unlisted settings are preserved or how a failed partial update behaves.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

One dense but well-ordered sentence front-loads the action and the two parameter families, then appends runtime and permission context. Parenthetical examples are compact and earn their space, though the sentence is long enough that the permission/scope facts would read better separated.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a six-parameter, all-optional mutation with nested objects and no output schema, the description covers both operating modes, the live-service effect, and the authorization requirement. Remaining gaps (merge semantics of 'partial', response shape) are minor since no output schema exists and the schema carries all parameter docs.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the baseline is 3, and the description mostly restates. It does add value by naming example setting keys (site_url, uri_allow_list, jwt_exp) and showing the provider_config shape ({enabled, client_id, secret}), which goes beyond the schema's generic 'Provider settings'. It says nothing about branch, project_id, or organization_id, but those are well documented in the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Change auth settings') and enumerates the two modes of operation: a partial settings object and/or a single provider configuration. The pair with auth.config.get is obvious from the naming, but the description never explicitly names the read-only sibling, so the differentiation is implicit rather than stated.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives prerequisites ('Needs an owner or admin', 'Scope: auth:write') and location ('Applied to the running auth service'), which tells the agent it must be privileged before calling. It does not say when to prefer this over auth.config.get, nor any when-not-to-use condition (e.g. use branch-scoped config versus production).

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.