VulKill Security

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations at all, the description carries the full behavioral burden and delivers the single most important fact for a credits tool: it starts no scan and consumes no credits. It also states the three classes of data returned. It does not mention authentication or authorization requirements, which is a remaining gap for an account-scoped lookup.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Two compact sentences, with the returned data front-loaded and the side-effect disclaimer last. The parenthetical "Watchdog: normal maks. + 15 dk" is terse to the point of being cryptic and slightly interrupts the flow, but there is no filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a zero-parameter read-only tool with no output schema and no annotations, the description discloses the data categories returned and confirms the absence of side effects – enough for an agent to call it safely. Only the unclear Watchdog duration note and missing auth context keep it from being fully complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool takes zero parameters, so there is nothing to disambiguate and the baseline of 4 applies. The description correctly adds no parameter prose, avoiding noise.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

Uses a specific verb ("gösterir" / shows) with concrete resources: current file and live-site credits, protection durations, and authorization scopes. That is enough to distinguish it from the scan-oriented siblings, though the grouping of three unrelated data sets into one tool makes the core purpose slightly muddled.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The sentence "Tarama başlatmaz ve kredi harcamaz" implicitly tells the agent this is the safe pre-scan lookup rather than an action, which differentiates it from vulkill_start_scan and vulkill_complete_scan. However, it never explicitly says when to call it (e.g. before starting a scan to verify remaining quota) or what to do if credits are insufficient.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden, and it does disclose two important side effects: findings are written to an external Live Reports page, and an aborted scan refunds credits with 0 deducted. It says nothing about idempotency, whether completion is terminal/irreversible, or what happens on a second call, which matters for a state-mutating terminal operation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Two tight sentences, with the primary effect front-loaded and the refund edge case placed second. Nothing is padded, though the URL reference consumes space without adding actionable meaning.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 4-parameter mutating tool with no annotations and no output schema, the description covers the main effect and the refund condition but leaves the payload parameters (summary, findings) and post-completion/repeat-call behavior undefined. An agent could invoke it but would be guessing on the data it should submit.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate and only partly does: it explains the semantics of 'started' (aborted scan refund) and refers to detailed findings without mapping them to the 'findings' or 'summary' parameters. The 600-character limit on summary and the expected array element shape for findings are left entirely undocumented.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb (sonlandırıp / terminate) plus the resource (a running MCP scan) and the outcome (detailed findings written to the app.vulkill.com/scans Live Reports screen). That makes the purpose unambiguous, though it never names a sibling such as vulkill_start_scan or vulkill_list_reports to sharpen the boundary.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives an explicit trigger condition — call it the moment the work is finished ('iş bittiği anda') — plus a conditional branch for the case where the scan never started (started: false triggers a full credit refund). There is no exclusion guidance, e.g. what to do if the scan has already been completed or is still running.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full load. It does disclose two useful behavioral facts: the operation is a read ('listeler') and it spends no credits ('Kredi harcamaz') — meaningful given a credit-checking sibling. However, it says nothing about pagination, ordering, or what happens when no reports exist.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short sentences, front-loaded with the action and scope, then the credit note. 'ayrıntılarıyla' (in detail) is mild filler but conveys report granularity, so almost nothing is wasted.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a zero-parameter read tool with no output schema, the description covers what it returns (scan reports), the state filter (live/completed), and the cost profile. Missing details — pagination, result ordering, and the empty-list case — are modest gaps rather than blockers.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool takes zero parameters, so the baseline is 4. Nothing in the description needs to explain parameter meaning, and it does not misrepresent the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description gives a specific verb and resource ('listeler' / lists, 'MCP tarama raporları' / MCP scan reports) plus scope ('canlı ve tamamlanmış' – live and completed, 'Hesabınıza ait' – belonging to your account). That is enough to separate it from siblings like vulkill_start_scan or vulkill_check_credits, though it does not explicitly name a sibling.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is only implied: it is the report-listing tool, so an agent should use it when it wants results. There is no explicit statement of when to prefer it over anything else, no prerequisites (e.g. must a scan have finished?), and no exclusions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations at all, the description carries the full burden, and it does disclose two critical behavioral facts: no scan is started and no credits are spent. Beyond that it is silent on permissions, rate limiting, idempotency, and what a 'plan' result contains, which leaves meaningful gaps for a tool with zero annotation coverage.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short sentences with no filler, and the key constraint about not spending credits is front-loaded in the second sentence. It is efficient, though the brevity is partly the cause of the missing detail elsewhere.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

No output schema and no annotations mean the description is the only source of behavioral information, and it is too thin for a tool whose whole purpose is to return a scoping plan. It also does not address the mode enum or what the agent should do with the plan once produced, and the Turkish-only text is misaligned with the English tool and parameter names.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%, so the description must compensate. It does map loosely onto all three parameters by naming file, live site and mode, but it never explains that 'files'/'sites' are numeric counts, gives no hints on sensible values or limits, and leaves the five mode enum values (auto, source, semantic, infrastructure, web) entirely unexplained.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a concrete action and inputs ('Dosya, canlı site ve mod için krediye bağlı tarama kapsamını planlar'), but 'planlar' is vague about what is actually produced or returned. It does not explain the 'guided_interactive' aspect of the tool name, so an agent cannot fully tell what this returns versus a real scan tool.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The negative framing 'Tarama başlatmaz ve kredi harcamaz' implies this should be called before committing credits, which is useful implied guidance. However, it never states when to use it explicitly, gives no prerequisites, and does not mention the only sibling (vulkill_check_credits) as an alternative or complement.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description usefully discloses report persistence, zero credit deduction if the scan does not start, the 5,000-file chunk limit, automatic task shutdown, and the Watchdog extension for stalled scans. It still omits the credit cost when a scan does start, whether execution is asynchronous, and practical details about active scanning or source handling.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The purpose and authorization restrictions are front-loaded, followed by concise operational details about credits, chunking, and timeouts. The sentences are dense, but nearly all of the content is useful and there is little repetition.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For an 11-parameter security-scanning tool with no annotations or output schema, the definition leaves substantial invocation gaps. Mode selection, target specification, the scan lifecycle, sibling-tool selection, and several input fields remain unexplained despite the useful authorization and operational context.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, and the description compensates only partially by explaining authorization categories and file chunking. It does not map its guidance to parameters such as mode, targetUrl, files, or sites, nor explain the required liabilityAccepted flag or the purpose of status, started, summary, and findings as inputs.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states that the tool starts authorized source-code or verified live-site scans and saves results to the Live Reports screen. It does not distinguish this direct scan starter from vulkill_scan_guided_interactive or explain its relationship to vulkill_complete_scan.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives explicit eligibility conditions: users may scan their own code, authorized organizational or client code, open-source or bug-bounty targets, or sites with verified ownership. However, it provides no guidance on when to choose the guided interactive sibling or how this tool fits into the overall scan workflow.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.