Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden of disclosing behavior. It tells the agent the tool reviews Secure/HttpOnly/SameSite flags but does not clarify what input it expects (e.g., a URL? a cookie header string?), what the output format is, or any side effects. The reviewer does not know if it performs a network request or parses local data. This is a significant gap for a tool with a single ambiguous parameter.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise and front-loaded with the key concept 'Cookie Audit'. It quickly conveys the security focus. It is a single sentence with no waste, but it sacrifices necessary detail for brevity. It earns a 4 for conciseness, though it lacks depth.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Despite having an output schema (which may define the response), the description does not provide enough context for an agent to use the tool correctly. The input parameter is ambiguous, the exact scope (what cookies? from a site?) is undefined, and there is no guidance on the expected input format. For a tool with a single ambiguous parameter and no annotations, this is incomplete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema has one parameter 'q' with a default value and 0% description coverage. The description does not explain what 'q' represents. It is unclear if 'q' is a URL, hostname, or cookie string. The description adds no meaning beyond the schema, which is nearly empty. With low schema coverage, the description should compensate, but it fails to do so.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description 'Cookie Audit: Secure/HttpOnly/SameSite flag review' clearly states the tool's purpose: it audits cookies and reviews security flags. It specifies the resource (cookies) and the action (audit/review), which is a clear enough verb+resource. It could be more explicit about what exactly the output is, but the core purpose is clear.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides no guidance on when to use this tool versus alternatives. There are no named alternatives or conditions for use. It simply defines the tool's function. An agent would not know if this tool is for auditing a website's set cookies, analyzing a cookie string, or something else, nor would it know when to choose this over other security tools like 'headers' or 'cors'.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.