Check a sha256 against the live public-root merkle via GET /api/proof?sha=. Three states only: VALID (included), INVALID (not a leaf), UNCHECKABLE (proof endpoint unreachable). Does not claim Ed25519 unless sig_ed25519 is present and checked separately. Never a grade.
| Name | Required | Description | Default |
|---|---|---|---|
| sha256 | Yes | 64-char hex digest to test for inclusion. |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries full responsibility. It discloses the three possible states (VALID, INVALID, UNCHECKABLE), including the unreachable-endpoint behavior, and explicitly states what the tool does not claim (Ed25519, grading). It also identifies the HTTP method and endpoint, making the operation's nature transparent.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three dense sentences with zero filler. The essential operation and endpoint are front-loaded, followed by the return-state contract and critical limitations. Every clause earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a single-parameter, no-output-schema tool, the description is complete: it explains what is checked, how (via GET), what the result states are, and what edge cases exist (unreachable endpoint, missing Ed25519). An agent has enough to call it correctly and interpret the result without additional context.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents the sha256 parameter. The description reinforces the meaning by linking the hash to the merkle proof endpoint, but it does not add format or constraints beyond what the schema provides. Baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description states a specific verb ('Check') and a specific resource ('sha256 against the live public-root merkle'), plus the exact endpoint. It clearly distinguishes its scope from any card-level verification and explicitly says 'Never a grade,' preventing confusion with tools that produce grades.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives clear context: use this to test a sha256 against the merkle proof endpoint. It also states exclusions: 'Does not claim Ed25519 unless sig_ed25519 is present and checked separately' and 'Never a grade.' However, it does not explicitly name sibling alternatives or say 'use X instead,' so it stops short of a full 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Add one secure layer between your agents and this server.
Each tool maps to a distinct operation: aggregate board totals, one axis row, a card leaf, the public root, the card index, signature verification, and inclusion verification. The descriptions carefully separate overlapping concepts such as measured vs. unmeasured, GSPC vs. public-root, and signature vs. inclusion, so an agent is unlikely to select the wrong tool.
Most tools follow a clear verb_noun pattern: get_axis, get_card, get_root, list_cards, verify_card, verify_inclusion. board_totals breaks the pattern by using a noun phrase rather than an imperative verb, but the naming is still snake_case, readable, and not chaotic.
Seven tools is well-scoped for a read-and-verify service: two GSPC board queries, three root/card retrieval or listing operations, and two verification checks. Each tool earns its place and there is no obvious redundancy.
The tool surface covers the full read/verify lifecycle: board totals, individual axes, root and card retrieval, card listing, signature verification, and merkle inclusion checks. Write or admin operations are not implied by the server's purpose, so there are no apparent dead ends.