Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations declare readOnlyHint, openWorldHint, and idempotentHint, so the safety profile is already known. The description adds valuable behavioral context beyond annotations: it incurs a cost ($5 per call), scans for specific risk categories (exfiltration, prompt-injection sinks, npm hooks, obfuscation), and returns a risk verdict with findings. It does not contradict annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single well-structured sentence that front-loads the core action and purpose, then packs in risk categories and the verdict type. Every clause adds information; there is no fluff or redundant repetition of schema field names.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (nested source object, paid call, no output schema), the description covers the essential context: what threat model it addresses, the verdict categories, and the cost. It lacks explicit detail on the return structure, but the mention of 'findings' and the verdict provides enough for an agent to understand the outcome. Sibling tools and remaining schema fields fill some gaps.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 50%: the previous_scan_id parameter is well described in the schema, but the required 'source' object has no field descriptions. The description partially compensates by indicating the two source entry modes ('git repo or code'), which maps to the source.type enum, but it does not explain nested fields like url, code, or language. This is adequate but leaves some ambiguity.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('Scan') and resource ('MCP server') with a clear objective ('supply-chain risk BEFORE trusting it'). It enumerates concrete risk categories and names the output verdict (PROCEED/CAUTION/BLOCK), distinguishing it from sibling scan tools like sast_scan or secret_scan by focusing on MCP supply-chain trust.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description clearly implies when to use the tool ('BEFORE trusting an MCP server') and frames it as a pre-trust assessment. It does not explicitly name alternative tools or state when not to use it, but the context strongly suggests it is for evaluating untrusted MCP servers, which is sufficient for most selection decisions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.