Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already flag this as destructive, non-idempotent, and non-read-only, so the safety profile is covered. The description adds real behavior beyond them: the current-password authentication requirement, the password complexity policy enforced by the server, and the SSO-account failure mode. What it does not disclose is whether changing the password invalidates other sessions or refresh tokens, which is the main behavioral unknown for a credential mutation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Three short sentences, front-loaded with the action, then the credential prerequisite, then the constraint, then the edge case. Every sentence carries distinct information and none is padding.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a two-parameter credential mutation with annotations covering the destructive and idempotency profile and no output schema to explain, the description supplies prerequisites, validation rules, and the SSO exclusion. The remaining gap is post-change side effects on active sessions, which an agent handling a password change would reasonably want to know. Overall it is complete enough to invoke correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must carry the burden, and it does: it establishes that currentPassword is the caller's existing credential and that newPassword must be at least 7 characters with upper, lower, and numeric characters. The complexity rule goes materially beyond the schema's bare minLength:7 on newPassword. It is docked slightly because nothing is said about whether special characters are permitted or whether the two fields may not be equal.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a concrete verb and resource ('Change the user's Caly password'), so the operation is unambiguous at a glance. It also names the sibling route for the SSO-only case, which is the most plausible confusion with a password tool, making it distinguishable from send_password_setup_email.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

It states the precondition ('Needs the current password') and an explicit when-not branch with the alternative to use instead ('Accounts that sign in only with Google or Apple have no password: use send_password_setup_email'). An agent practically cannot pick the wrong tool after reading this.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.