Httpmethods
httpmethodsHTTP Methods: Allowed methods + TRACE/risky-verb check
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| q | No |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||
httpmethodsHTTP Methods: Allowed methods + TRACE/risky-verb check
| Name | Required | Description | Default |
|---|---|---|---|
| q | No |
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||
Changes observed during successful MCP inspections.
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations (no readOnlyHint, destructiveHint, etc.), the description must disclose behavior. It states that it performs a 'check' for allowed methods and risky verbs, but it does not explain whether this involves making a network request to the target, what input is expected (domain/port?), or any side effects. The term 'TRACE/risky-verb check' hints at a security assessment, but the lack of detail about the actual behavior (e.g., does it send a TRACE request?) is a gap.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely brief, a single line, which is concise and front-loads the core purpose. However, given the ambiguity around parameters and behavior, the brevity arguably contributes to underspecification rather than efficiency. Still, for what it does convey, it is well-structured.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With one parameter at 0% schema coverage, no annotations, and a vague output schema (though it exists), the description is incomplete. The tool's functionality is sufficiently complex (checking HTTP methods, risky verbs) that the agent needs more context about input format, output structure, and the nature of the check. The output schema could help, but the description adds little to complete the picture.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema has one parameter 'q' with no description, and schema description coverage is 0%. The description does not mention the parameter at all. Since there are no enums and no examples, the agent has to guess what 'q' represents (likely a URL or domain). This is a significant shortfall because the description must compensate for the missing schema parameter documentation, and it does not.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description 'HTTP Methods: Allowed methods + TRACE/risky-verb check' clearly indicates the tool checks allowed HTTP methods and flags risky ones like TRACE. It is specific about the resource (HTTP methods) and the action (check). This distinguishes it from generic HTTP tools like httpcode and httpstatus, which report status codes, though it doesn't explicitly name them.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies this tool is used when you need to know which HTTP methods are allowed on a server, and specifically to check for risky verbs like TRACE. However, there is no explicit statement about when to use it versus other HTTP-related tools (e.g., httpstatus, headers, ssl). The agent must infer the use case from the description.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Add one secure layer between your agents and this server.