Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Goes well beyond the readOnlyHint/openWorldHint annotations by disclosing data provenance, staleness risk, and a full pricing/payment model: $0.002 USDC per successful call via x402 across three chains, with failures not charged. This is exactly the kind of cost and freshness context an agent needs before invoking a metered tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Three tight sentences: what it returns and from where, then the freshness/scope caveat, then cost. No repetition of the title or restatement of the name, and the most decision-relevant constraint leads.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a single-parameter lookup with an output schema and read-only annotations, the description covers every open question an agent has: provenance, freshness limits, scope limits, and monetary cost. Nothing needed to call it correctly is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% and the single parameter is already documented as an IPv4 address with an example. The description reinforces IPv4-only scope by framing the lookup around an IPv4 address, but adds no format or validation detail beyond the schema, so baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

States the exact data source (Shodan pre-collected passive scans) and the exact outputs (port 22 open status and OpenSSH version from the CPE list). Explicitly distinguishes this from live banner-grab/algorithm-audit tools, which separates it from siblings like security_open_port_scanner and security_shodan_host_summary.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives clear context for when the result is appropriate — passive, possibly days old — and rules out live verification use cases. It does not name the sibling tool an agent should call instead for a fresh check, so the routing decision is left slightly implicit.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.