Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint, idempotentHint, destructiveHint=false and openWorldHint, so the safety profile is covered. The description still adds real behavioral context beyond them: plain GET/HEAD only, never logs in, never submits forms, 24-hour per-URL caching with fresh=true to bypass, and the explicit boundary that it cannot see source code or every route/table.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The opening sentence front-loads the trigger and action, and the numbered check list is dense but each item is concrete rather than filler. It runs long, but the length is justified by the breadth of what the scan returns and the scope limits; little could be cut without losing routing information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return format need not be explained, and the description still covers authorization requirements, the read-only boundary, caching/freshness behavior, coverage limits, and the sibling escalation path. An agent has everything needed to select and invoke it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% so the baseline is 3, and both parameters are already documented in the schema. The description still adds value by explaining the caching mechanic (24 hours per URL) and tying fresh=true to the post-deploy re-scan workflow, which clarifies when the flag is actually warranted.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

States a concrete verb (scans the deployed app from the outside) and resource (live URL) and enumerates the eight check categories, so the agent knows exactly what comes back. It also differentiates itself from siblings by naming request_human_review as the manual alternative and framing itself as launch-readiness rather than a code audit.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives explicit when-to-use ('before shipping, or right after deploying'), when-not ('not a code audit: it cannot see source code or test every table or route'), prerequisites ('only scan apps the user owns or is authorized to test'), and a named escalation path to request_human_review for hand review. Nothing is left to inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.