Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full behavioral burden and does so well: it discloses that metadata is redacted, that the key hash/full secret is never returned, that API-key auth is required, and that JWT auth yields a specific error. These details go beyond what the empty schema or annotations provide.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact and front-loaded: purpose first, then behavioral guarantees, then auth requirements and access instructions. Every sentence adds useful information, and the ACCESS block is a clear, separated directive.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a zero-parameter, no-output-schema tool, the description is complete: it lists the returned fields, explains auth failure modes, and tells the agent how to remediate the access issue. An agent can invoke it correctly without further documentation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters and schema coverage is 100%, so the baseline is 4. There are no parameters to explain, and the description appropriately focuses on behavior instead of inventing parameter details.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'Get the calling API key's own redacted metadata', followed by an explicit field list. It clearly distinguishes itself from siblings like list_api_keys or get_current_user by scoping to the current API key's metadata.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

It states the intended use case ('for agent self-inspection') and gives a clear precondition: requires API-key auth, while a JWT session returns 400. It also warns that start_login does not open this tool, providing an exclusion. However, it does not explicitly name alternative tools for user or key-list scenarios.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.