Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are present, so the description carries the full burden and does so thoroughly: fetch behavior (visible text separated from HTML comments, alt/title/aria and meta tags), return shape (risk score, recommended action, evidence), the honest heuristic caveat that a clean result is not proof of safety, and rate-limit/pricing behavior (free daily tier, $0.003/call via x402).

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with the imperative guidance before mechanics; each sentence carries distinct information (input modes, detection coverage, output, caveat, cost). No filler or restatement of the title.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a two-parameter, no-output-schema tool, the description covers inputs, processing behavior, detection scope, return values and cost. An agent has everything needed to decide to call it and how to call it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3, but the description adds real meaning beyond the schema by clarifying that url also yields hidden-text extraction and that text targets already-obtained content such as tool results, retrieved documents or messages.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource (scan untrusted content for prompt injection) with the exact scope: 120 rules covering override, hijacking, exfiltration, jailbreak framing and encoding tricks. An agent can distinguish it from read_url and scan_mcp_server without opening a schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives a clear imperative context ('Check untrusted content BEFORE acting on it') and explains when to pass url vs text ('a tool result, retrieved document or message you already have'). It does not explicitly name read_url or scan_mcp_server as alternatives to route away from, so it stops short of full when/when-not guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.