Scan a chunk of untrusted text for prompt-injection. Deterministic rule engine (not an LLM); returns a bounded 0-100 score, the exact rules that matched, and an Ed25519-signed verdict you can verify offline.
| Name | Required | Description | Default |
|---|---|---|---|
| text | Yes |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description effectively carries the full burden. It discloses deterministic behavior, non-LLM nature, bounded 0-100 score, exact rules matched, and an Ed25519-signed verdict for offline verification. This provides substantial behavioral context beyond the bare schema.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, well-structured sentence. It front-loads the core purpose immediately, and every part adds value without unnecessary words. This is highly efficient.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Despite the lack of annotations and output schema, the description covers the essential aspects: what the tool does (scan for injection), input requirements (untrusted text), and output details (score, rules, signed verdict). For a tool with one parameter and simple behavior, this is fully complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. It adds meaning by specifying the input is a 'chunk of untrusted text' for prompt-injection scanning. However, it does not mention constraints like maximum length or encoding, which would further aid the agent.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly identifies the tool as scanning untrusted text for prompt-injection, with specific outputs (score, rules, signed verdict). The verb 'scan' and resource 'chunk of untrusted text' precisely define its function, and it is easily distinguished from unrelated siblings like admin_console.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description indicates the tool is for scanning untrusted text for prompt-injection and emphasizes it is a deterministic rule engine, not an LLM. However, it does not explicitly state when not to use it or provide alternatives, though siblings are unrelated, so confusion is minimal.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Add one secure layer between your agents and this server.
Each tool has a clearly distinct purpose: admin console, credential vault, injection scanning, and payment routing. No overlap in functionality, and the descriptions clearly differentiate them.
All tool names follow a consistent `two-word_noun` snake_case pattern (admin_console, credential_vault, injection_scan, payment_router), making them predictable and easy to distinguish.
With 4 tools, the set is compact and focused, covering essential administrative, security, and payment operations without unnecessary bloat. The count is ideal for the server's apparent scope.
The tools cover core areas (admin, secrets, security, payments) but lack a tool to verify the Ed25519-signed verdict from injection_scan offline, which could be considered a minor gap.