Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already cover safety (readOnly, idempotent, non-destructive, closed-world), and the description adds substantial non-schema behavior: normalization of host bits, overlap counted once, the >10000 output CIDRs hard error with no partial result, error payloads identifying list and zero-based index, remote-vs-browser execution, and telemetry/privacy disclosure with exclusions about what is not logged.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Purpose and constraints are front-loaded, which is good, but the definition runs long and the tail paragraphs on operational events and privacy policy are verbose relative to their value for tool selection. Information density is high but structure is closer to a compliance statement than a tight tool description.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, yet the description still enumerates the returned fields and the empty-list success case and the error case, alongside all input constraints. For a pure computation tool with two array params, nothing an agent needs to invoke it correctly is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the baseline is 3; the description then adds cross-parameter constraints the schema cannot express — one address family across both lists, a combined 1000-entry budget, 64-character limit, exclude allowed to be empty, include required nonempty, and the semantic consequence that an empty exclude simplifies the exact union.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

States a precise operation as a formula — 'Compute union(include) minus union(exclude) as a minimal sorted canonical CIDR list, without adding addresses' — plus a concrete use case (WireGuard AllowedIPs exceptions). The phrase 'without adding addresses' implicitly separates it from aggregating siblings like cidr-cover, and the explicit non-goals ('does not inspect live allocation... change firewall rules') further bound what the tool is.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives clear triggering contexts (prepare WireGuard AllowedIPs exceptions, calculate remaining address space) and explicit when-not-to-use cases. It does not name any sibling tool (cidr-cover, range-to-cidrs, public-ip) or state which to pick instead, so it stops short of full routing guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.