Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations only set false flags, so the description carries the burden. It discloses critical behaviors: the signing secret is shown only once and must be stored, calling again replaces the endpoint and issues a new secret, and it enables push-based delivery. No contradictions with annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Three sentences, each purposeful: purpose and benefit, the one-time secret warning, and replacement behavior. No filler, front-loaded with the main intent.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers the essential behavioral aspects: why to use it, the critical secret handling, and the replacement behavior. With an output schema present, it need not explain return values. It is sufficiently complete for a tool with only two parameters.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, with both url and events already described (e.g., url must be publicly reachable, events default to message.inbound). The description adds no extra parameter-level details; the secret is an output, not a parameter. Baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action ('Register an HTTPS endpoint') and its purpose (receive inbound WhatsApp messages as they arrive), and explicitly contrasts with polling wa_list_messages, distinguishing it from a common alternative. The resource and verb are specific, and it is unambiguous what the tool does.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives a clear use case: use this instead of polling when you want push notifications. It also notes that calling again replaces the endpoint, implying when to reuse. It does not explicitly mention when to use wa_delete_webhook or wa_enable_webhook, but the primary context is well covered.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.