agentguard — policy proxy for agent tool calls

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Adds real behavioral context beyond the annotations: the returned proxy key is 'shown once', and the proxy is addressed with a Bearer key, plus the account-key requirement. Annotations already cover the mutation safety profile (readOnlyHint=false, idempotentHint=false), so the extra auth and one-time-secret details are the valuable additions.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Four tight sentences, front-loaded with the action, then the return values, then the client wiring, then the auth prerequisite. No filler or repetition of schema content.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema present, the description usefully discloses the return payload (proxy id, MCP URL, one-time key) and the auth requirement. It omits retry/non-idempotency implications for a creation tool and any limits or naming collision behavior, but is otherwise sufficient to call correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents all four parameters including the mode enum and its dry-run guidance. The description adds nothing about parameter formats, so the baseline of 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

Specific verb ('Create') plus a concrete resource ('hosted agentguard proxy in front of an MCP server'), which no sibling tool duplicates. An agent can distinguish this from agentguard_set_policy or agentguard_get_run without opening the schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description states the prerequisite ('Requires an account key') but gives no explicit when-to-use versus alternatives and no exclusion conditions. Usage is only implied by the fact that none of the siblings perform proxy creation.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the read-only/idempotent annotations, it discloses that args are redacted, that entries are hash-chained, that verification is offline via sha256(prev_hash + canonical(entry)), and that an account key is required. That is substantive behavioral context the annotations do not carry.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Three tight sentences, front-loaded with what is exported; the verification formula is dense but earns its place. No filler, though the parenthesis list is slightly crammed.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description usefully describes the returned structure (chained entries plus Merkle root) and the verification path. Missing only guidance on how the export is delivered (file vs inline) and any size/rate considerations.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so both runId and proxyId are already fully documented in the schema. The description adds no syntax or format detail for either parameter, so the baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Export a run's hash-chained audit entries') and enumerates the payload contents (prev_hash, hash, redacted args, Merkle root), making it clearly distinct from siblings like agentguard_get_run.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

It names use cases ('for disputes and questionnaires'), which implies when to reach for it, but never states when NOT to use it or contrasts it with agentguard_get_run, which an agent could easily confuse for audit retrieval.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint and idempotentHint, and the description adds useful behavioral context beyond them: it is machine-readable, equivalent to /pricing.json, and includes the unattended-purchase caveat for per_call. There is no contradiction with the annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single dense sentence that packs in a lot of relevant detail, from plan bands and threshold percentages to the separate purchase endpoint. It is not perfectly front-loaded or broken into scannable parts, but every clause earns its place and there is no filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema and no parameters, the description carries the burden of explaining what the agent will receive, and it does so extensively: bands, included calls, alerts, features, trial allowance, and per_call details. It could explicitly state the response format or that it returns this pricing data, but 'machine-readable' and the /pricing.json comparison make that adequately clear.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool takes zero parameters and the schema is fully documented by virtue of being empty, so the baseline of 4 applies. There are no parameter semantics to explain, and the description appropriately focuses on the returned data instead.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly identifies the tool as the source of machine-readable pricing for agentguard hosted, enumerating the exact data it exposes: plans, included tool calls, thresholds, trial allowance, features, and per_call pricing. It is unmistakably distinct from the sibling tools, which involve proxy creation, audit export, runs, allowlist recommendations, and policy setup.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The context makes it clear this is the pricing lookup tool, and the description adds important routing guidance by noting that per_call purchases happen at POST /api/v1/calls. It does not explicitly state when not to use this tool or contrast it with a pricing sibling, but no such sibling exists, so the implied usage is sufficient.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already cover the safety profile (readOnly, idempotent, closed-world), but the description adds real behavioral context not present in structured data: the auth requirement of an account key and a disclosure of what the report contains, including 'dry-run mutations (what would have changed)'. This is valuable since no output schema exists.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences: the first front-loads the purpose and contents, the second states the prerequisite. Dense but efficient, with no filler. The long enumerated clause is justified because no output schema exists to describe the return.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a read-only reporting tool with no output schema, the description compensates by enumerating the returned sections (counts, timeline, dry-run mutations, ledger entries, audit-chain verification). Missing is any guidance on run lifecycle or relationship to agentguard_export_audit, but overall an agent has enough to call it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, with both runId and proxyId well documented in the schema itself, so the baseline is 3. The description's 'Requires an account key' is an auth note rather than parameter guidance and does not add semantics for the two declared parameters.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('get run' returning an incident-shaped report for one run) and enumerates the report contents, giving the agent a concrete picture of the artifact. It does not explicitly distinguish itself from the overlapping agentguard_export_audit sibling, which also concerns the audit chain, so it falls short of a 5.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is implied by the scoping ('for one run', 'one run is one agent session' in the schema) and there is an explicit prerequisite ('Requires an account key'). However, there is no statement of when to prefer this over agentguard_export_audit or how it relates to other siblings.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already cover the safety profile (readOnlyHint, idempotentHint true; openWorldHint false), and the description adds real context beyond them: the recommendation is deterministic (no LLM call), it is advisory only and must be applied in the dashboard, it requires an account key, and the recommendation is drawn from previously recorded calls. It stops short of describing recomputation cadence or how much recorded data is needed.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Three short sentences with zero filler: the payload is front-loaded, the advisory-only caveat follows, and the auth prerequisite is last. Every clause carries information an agent needs.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description compensates by enumerating the returned artifacts (allowlist, argument keys, unused upstream tools). Combined with the single fully documented parameter and complete annotations, nothing required to invoke or interpret this call is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Only one parameter exists and schema description coverage is 100%, with proxyId already documented as the id returned by agentguard_create_proxy. The description's phrase 'from the proxy's recorded calls' loosely reinforces that proxyId selects the recorded dataset, but adds no new syntactic or formatting meaning. Baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

Names a specific verb and resource — a least-privilege allowlist recommendation derived from recorded proxy calls — and enumerates exactly what it returns (minimal allowlist, per-tool argument keys, unused upstream tools). It is clear what the tool does, but it never contrasts itself with siblings like agentguard_set_policy or agentguard_export_audit, so an agent must infer the boundary.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

'No LLM call here; apply it in the dashboard' establishes that this tool only computes a recommendation and that the change is applied elsewhere, which is useful implied context. However, there is no explicit when-to-use/when-not guidance or named alternative (e.g. set_policy) for actually applying the allowlist.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations cover the write-safety profile (readOnlyHint=false, idempotentHint=true, destructiveHint=false), and the description still adds real behavioral context: validation before saving, a 30-second propagation window, and an account-key auth requirement. Only the full-replace (non-merge) semantics and error behavior on invalid YAML are left out.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Three short, front-loaded sentences with zero filler: what it does, what the payload looks like, then validation/latency/auth constraints in descending order of importance.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema and a two-param mutation tool, the description supplies the operational facts an agent needs (auth, validation, effect latency). It is slightly thin on failure modes and on whether the replaced policy can be retrieved beforehand, but nothing critical is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3, and the description earns credit by naming the policy sections (mode, upstreams, classify, caps, loop, dry_run, approvals, alerts, chaos, drift) that the YAML string must contain. This gives the agent a concrete mental model of the payload beyond the schema's "complete policy document".

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

Starts with a specific verb+resource ("Replace a proxy's policy") and enumerates the YAML sections the policy document covers, so the scope is unambiguous. It does not explicitly contrast itself with siblings like agentguard_create_proxy, but the replace-vs-create distinction is inferable from the names.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is implied (mutate an existing proxy's policy) and one prerequisite is stated ("Requires an account key"), but there is no explicit when-to-use vs when-not, and no routing to alternatives such as agentguard_create_proxy for a proxy that does not yet exist.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the readOnly/idempotent hints, the description adds meaningful behavioral context: 'The log is read in the request and discarded; nothing is stored' (privacy), 'Needs no account and no key' (auth), and the provenance of caps ('Caps come from the proxy's own default policy'), which explains why band refusals are authoritative. No contradiction with annotations; all claims align with readOnlyHint=true.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Three paragraphs with zero filler: the first front-loads purpose and outputs, the second covers inputs and privacy, the third covers caps provenance and sibling routing. Every sentence earns its place, and the most decision-relevant information is placed first.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema present, the description carries the full burden of explaining return contents — and it does so thoroughly, enumerating every report element and the difference between `concise` and `full`. Combined with the annotated safety profile, complete parameter docs, and alternative-routing, nothing an agent needs to invoke this correctly is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% and both parameter descriptions are already detailed (verbatim log content, no paths/URLs; concise vs full output). The description adds value by expanding the accepted format list with the exact field names (`tool`, `ts`, `class`, `amount_usd`, `rail`, `run_id`, `model`, `input_tokens`, `output_tokens`), which is genuinely useful beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb+resource ('Read an agent log and report what it spent') and enumerates the full set of outputs: totals, calls by tool and class, estimated dollars by rail, loops, largest run, and per-overspend band/cap/tripping call. This unambiguous scope clearly distinguishes it from siblings like agentguard_export_audit (produces the log) and agentguard_set_policy (mutates policy).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly routes the agent away from this tool for a related purchase task: 'the calls-only purchase an unattended agent can complete is in `agentguard_get_pricing` instead.' It also specifies accepted input types (audit export, Claude Code .jsonl, CSV/JSONL of tool calls) and gives usage conditions for the `detail` parameter ('Ask for `full` only when you are going to read it').

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.