Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, destructiveHint=false, and openWorldHint=false, so the safe read-only nature is covered. The description adds useful output context (coverage percentages, gap counts, mapped controls) but no additional behavioral details such as permissions, scoping to diagrams, or rate limits.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

A single, front-loaded sentence with zero filler. It states the verb, the returned data, and the framework scope immediately.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

No output schema exists, so the description must explain return values, and it does so by naming coverage percentages, gap counts, and mapped controls. It does not explain that results are scoped to a diagram or describe pagination, but it is largely complete for a simple read tool whose safety profile is covered by annotations.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents framework, diagram_id, and include_graph. The description names additional frameworks such as SOC 2, but this only marginally extends the framework parameter examples and adds no meaning for the required diagram_id or include_graph parameters. Baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Get control-mapped coverage percentages, gap counts, and mapped controls') and lists the compliance frameworks covered. This clearly describes the tool's function, but it does not explicitly differentiate it from sibling tools such as compliance_status or get_cloud_compliance.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides no when-to-use guidance, prerequisites, or mention of alternatives. It implies a coverage-reporting purpose through the name and phrase 'control-mapped coverage,' but offers no routing information for an agent choosing among the many compliance-related siblings.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.