Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden and succeeds exceptionally: it reveals that email is the only dispatched channel, explains channel-specific user actions (deep_link, sms_message, sms_dids), warns about qr_text semantics, and notes the email magic-link possibility. It also discloses access and authentication requirements, going far beyond minimum disclosure.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is long but well-structured: the core purpose and return values are front-loaded, followed by a numbered operational flow and warnings. Every sentence carries functional content for the agent (channel behavior, protocol steps, auth). While it could be tightened, the length is justified by the tool's complexity.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Despite having no output schema, the description thoroughly explains return fields and conditional outcomes (session_id, deep_link, qr_code, qr_text, instructions, requires_email_selection, available_emails), as well as the polling and completion flow including expiration handling. It also covers authentication prerequisites operable within the MCP environment. For this complex tool, the description is effectively complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema already covers 100% of parameters with descriptions and enums. The description adds value by explaining the situational role of `email_id` (needed when `requires_email_selection` is true) and by framing `action_type` as the sensitive operation being protected. It does not redefine enums, but that is unnecessary given the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states that the tool starts a 2FA challenge, sends a verification code, and lists its return values (session ID, deep_link, qr_code, qr_text). It is specific and unambiguous, but it never distinguishes this tool from the sibling `start_2fa_for_action`, so it loses the full 5 for sibling differentiation.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description contains an explicit numbered 'Agent usage' flow that tells exactly when to call the tool, how to handle each channel, and what to avoid (e.g., not announcing unsent messages, not passing qr_text to a link renderer). However, it does not mention alternative 2FA-starting tools or conditions in which a different tool should be used, so it provides clear context but no exclusions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.