agentguard — policy proxy for agent tool calls

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations cover the safety profile (readOnly=false, idempotent=false, openWorld=false), so the bar is lower, and the description adds genuinely useful behavior: the proxy key is returned 'shown once', the return payload is enumerated, and an account key is required. It stops short of noting slug-uniqueness or idempotency consequences of re-calling.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Three tight sentences, front-loaded with the action and its scope, then the return contract, then the integration detail. Every sentence carries information an agent needs; nothing is padded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

There is no output schema, but the description compensates by enumerating the returned fields (proxy id, per-customer MCP URL, key). Auth requirement and client wiring are covered. Minor gaps remain around failure modes (duplicate slug, key loss) for a non-idempotent creation tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so all four parameters (including the dry-run/enforce mode with its default) are already documented in the schema. The description adds no parameter-level detail beyond that, which is the expected baseline when the schema does the heavy lifting.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Create a hosted okgate proxy in front of an MCP server') with clear scope. The sibling tools (audit export, pricing, policy, spend report) are functionally unrelated, so no differentiation is needed and none is confusingly implied.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies the situation (you have an MCP server you want to front with a proxy) but never states when to choose this over alternatives or what prerequisite state is required beyond 'Requires an account key'. The client-configuration sentence describes post-creation usage, not when-to-invoke guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already cover the safety profile (readOnly, idempotent, non-destructive, closed-world), so the bar is lower. The description still adds real value by disclosing what is exported, that args are redacted, and the offline verification recipe sha256(prev_hash + canonical(entry)), plus the account-key auth requirement.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Three short sentences: output/scope first, verification method second, prerequisite last. No filler, no repetition of the schema, and the most important information is front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a two-parameter read-only export with no output schema, the description covers contents, integrity semantics, verification, and auth. It stops short of saying the export format/channel (e.g., JSON blob vs. downloadable artifact) or any size limits, which is the only remaining gap.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% and both required params (runId, proxyId) are documented in the schema, including the run/session semantics and the cross-reference to okgate_create_proxy. The description adds no parameter-level detail, so the baseline 3 is correct.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Export a run's hash-chained audit entries ... with the Merkle root') and enumerates the payload contents (prev_hash, hash, redacted args). This is clearly distinct from siblings like okgate_get_run or okgate_spend_report without needing to open any schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Names a use context ('for disputes and questionnaires') and a prerequisite ('Requires an account key'), which implies when to reach for it. However, it never contrasts with okgate_get_run or any other sibling, and gives no when-not guidance, so routing still requires inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already establish readOnly/idempotent/non-destructive, so the bar is lower; the description still adds real behavioral context by disclosing that the payload mirrors /pricing.json and by distinguishing agent-completable purchases (per_call via POST /api/v1/calls from a prepaid balance) from human-only Stripe Checkout one_time purchases.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with the core resource and then enumerates payload sections in a single dense sentence; the trailing note about /pricing.json is small and useful. It is on the long side with heavy dash-clause nesting, but every clause carries information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

A read-only informational endpoint with no output schema, so the description carries the burden of describing the return contents — and it does so by enumerating bands, thresholds, features, trial, per_call and one_time. Exact field structure is still left unstated, but an agent can call this correctly with what is given.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Zero parameters, so there is nothing to disambiguate; baseline 4 applies. No parameter-level claims are made that could mislead.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb+resource (get pricing for okgate hosted) and enumerates the payload precisely: bands, included tool calls, 80%/150% thresholds, trial allowance, per_call, one_time. It does not distinguish itself from the sibling okgate_spend_report, which an agent could plausibly confuse with pricing/rate information.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is implied rather than stated: an agent reads it when it needs rates or purchase paths. It does add one actionable usage fact — that per_call is the only purchase an unattended agent can complete — but there is no explicit when-to-use vs okgate_spend_report or any exclusion guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnly/idempotent/non-destructive, so the safety profile is covered; the description adds the auth requirement (account key) and discloses the substantive shape of what comes back, including dry-run mutations and audit-chain verification. It does not mention pagination, size limits, or behavior when the run id is unknown.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, purpose front-loaded, and the parenthetical enumeration of report sections earns its space by substituting for a missing output schema. The single long sentence is dense but not padded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description compensates by enumerating the returned sections (counts, timeline, dry-run mutations, ledger, audit chain), and it flags the account-key requirement. Minor gaps remain around error behavior for an unknown runId and any retention or size caveats.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% and both parameters are fully documented there, including the 'one run is one agent session' semantics and the provenance of proxyId. The description adds no format, syntax, or constraint detail beyond the schema, so the baseline of 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific resource ('the incident-shaped report for one run') and enumerates its contents, so the agent knows exactly what call returns. It is clearly the per-run inspection tool rather than a fleet-wide report, though it never names okgate_spend_report or okgate_export_audit as the alternatives it is distinguished from.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is implied by the content list (inspect a single run's decisions, dry-run mutations and audit chain) and one prerequisite is given ('Requires an account key'). There is no explicit when-to-use/when-not statement and no routing guidance versus the sibling reporting tools.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description adds context beyond the annotations: it discloses that no LLM call is made, that the result must be applied externally in the dashboard (i.e. the tool itself has no side effects despite readOnlyHint=false), and that an account key is required. It does not explain what happens if no calls were recorded or how fresh the analysis is.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Three tight sentences, front-loaded with what the tool returns, followed by operational notes (no LLM call, apply in dashboard, account key). Dense but every clause carries information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema and a single well-documented parameter, the description usefully enumerates the return contents and states the auth prerequisite. An agent can call it correctly, though it lacks guidance on freshness, empty-result behavior, or the follow-up set_policy step.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% for the single proxyId parameter, whose schema description already points to okgate_create_proxy. The description only implies the recommendation is scoped to a proxy's recorded calls, adding marginal semantics beyond the schema. Baseline 3.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource: it produces a least-privilege tool allowlist from the proxy's recorded calls, and enumerates the outputs (minimal allowlist, per-tool argument keys, unused upstream tools). It distinguishes itself from the mutating sibling okgate_set_policy by noting 'apply it in the dashboard', though it never names a sibling directly.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is implied rather than prescribed: 'apply it in the dashboard' tells the agent this tool only recommends, and 'remove them first' gives ordering guidance. There is no explicit when-to-use/when-not or named alternative, so an agent must infer the workflow position.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare destructiveHint=true, idempotentHint=true, and readOnlyHint=false, so the safety profile is covered. The description adds genuinely new context: validation happens before saving, propagation takes up to 30 seconds, and an account key is required. It stops short of describing failure behavior or whether the prior policy is retained on error.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Two compact sentences with zero filler; the verb, resource, and YAML scope are front-loaded, followed by the operational facts (validation, latency, auth). Every clause carries information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description still covers the essentials an agent needs: the full-replacement semantics, validation gate, propagation delay, and auth requirement. Minor gaps remain around error/rollback behavior for a destructive write.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% with both parameters documented, so the baseline is 3. The description goes further by enumerating the policy YAML's constituent sections, giving real semantic content about what policyYaml must contain beyond the schema's 'complete policy document' note.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Replace a proxy's policy') and enumerates the policy document's sections (mode, upstreams, classify, caps, etc.), so the scope is unambiguous. It does not explicitly contrast itself with the sibling okgate_create_proxy, which the rubric reserves for a 5.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is implied: it operates on an existing proxy (proxyId from okgate_create_proxy) and replaces rather than merges. However, there is no explicit when-to-use/when-not guidance or comparison against alternatives, and no statement about what happens if validation fails.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnly/idempotent/non-destructive/openWorld=false, so the safety profile is covered. The description meaningfully adds that no account or key is needed, that the log is read in-request and discarded (nothing stored), and that caps derive from the proxy's own default policy — behavioral facts not present in any structured field. It omits error handling and size limits.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Three short paragraphs that are front-loaded with outputs first, then input formats/privacy, then the cap-routing note. Every sentence carries information, though the middle paragraph's enumeration of accepted field names is dense and slightly long-winded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description carries the burden of describing the return, and it does so explicitly by enumerating every report section including the overspend band and tripping call. For a stateless read-only analysis tool, an agent has everything needed to call it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3. The description goes beyond the schema by naming the accepted input shapes in detail — agentwares.audit/v1 exports, Claude Code .jsonl sessions, or CSV/JSONL with the recognized field names — which helps an agent decide whether its data qualifies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The opening clause gives a precise verb+resource ('Read an agent log and report what it spent') and then enumerates the exact report sections: totals, calls by tool and class, dollars by rail, loops, largest run, and per-overspend band/cap/call. It also names a sibling (okgate_get_pricing) to route the adjacent purchase task, so an agent can separate it from the other okgate tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

It states the triggering context clearly (auditing a spend log) and explicitly redirects the buying path to okgate_get_pricing, which is real sibling differentiation. It stops short of stating when NOT to use this tool or how it relates to get_run/export_audit, so it is clear context without full exclusions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.