Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnly, idempotent, non-destructive, and open-world, so the safety profile is covered; the description adds substance beyond that by disclosing the return shape (verdict, findings, sanitized copy) and the sanitization behavior itself (invisible characters and hidden HTML removed). It stops short of stating latency, size limits, or what happens on ambiguous content, but for a read-only scanner this is solid added context.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The purpose and trigger are front-loaded and the return values come immediately after, which is the right order. However, the capitalized 'BEFORE' and the rhetorical 'any content that came from outside your trust boundary' framing plus the four-item action list repeat the same intent across the two paragraphs, costing tokens without adding decision-relevant information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

There is no output schema, so the description must carry the return values, and it does — verdict, findings, and sanitized text. Combined with a fully documented three-parameter schema and a rich annotation set, an agent has enough to call this correctly; only edge-case behavior (what constitutes a finding severity, failure modes) is left unexplained.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so mode, format, and content are already documented in the schema, including the enum meanings. The description adds only indirect meaning — that a 'sanitized copy' is produced, which hints at why redact mode exists — but does not explain how mode or format choices affect the verdict or findings.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (scan), a specific resource (text or HTML you already hold), and a specific target threat (prompt injection) with timing (before you reason over it). The parenthetical enumeration of sources (tool result, email, file, search snippet, agent message) and the 'you already hold' framing distinguish it from the sibling cordon_read, which presumably fetches content rather than analyzing what you have.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives a clear triggering condition — content from outside the trust boundary that will influence an action — and lists concrete high-stakes actions (sending data, running a command, spending money, calling a tool). What it lacks is an explicit exclusion or a named alternative for the case where content is already trusted or comes from a source you have not yet fetched, which is where cordon_read would enter.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.