Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden. It discloses that no key is required and that a credential count is returned, but it omits other behavioral traits such as rate limits, data freshness, read-only nature, or any potential latency. This is a significant gap for a tool in a security data context.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, compact sentence that efficiently conveys the core function and key differentiators (Hudson Rock, no key). It is front-loaded with the most important information and avoids unnecessary words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the existence of an output schema, return format is covered elsewhere, but the description lacks input semantics and usage guidance. For a tool among many similar breach-lookup tools, this incomplete context would likely cause an agent to misuse it or select it incorrectly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema has one parameter q with a default but no description, and schema coverage is 0%. The description does not explain what q should contain (e.g., email, domain, IP), which is critical for correct invocation. There is no compensation for the missing schema description.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific purpose: 'infostealer compromise check' using Hudson Rock data, and mentions credential count and no key requirement. This distinguishes it from many breach-related siblings like hudsonrock, leakcheck, etc., though the phrasing is terse and could be more explicit about the exact resource and input type.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

No explicit guidance on when to use this tool over alternatives. The 'no key' hint implies a differentiator from tools like hudsonrock, but it doesn't directly compare or state conditions for selection. The agent is left to infer usage context from the name and description alone.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.