security-preflight

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, idempotentHint=true, destructiveHint=false, and openWorldHint=false, so the safety profile is covered without the description's help. The description adds that the call reports an "evidence boundary" and enumerates inputs and outputs, which hints at the nature of the content returned. It stops short of saying anything about authorization requirements, whether the answer is static or reflects current system state, or how the evidence boundary is determined.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

It is a single short sentence with no filler, and the four listed facets are front-loaded. The only cost is that the terseness shades into under-specification rather than economy. Nothing is wasted, but nothing is expanded either.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

This is a simple, zero-parameter read tool with full annotation coverage and an output schema, so the description needn't explain return values. Even so, for a tool whose entire job is to explain scope and evidence boundaries, the one-liner is thin: it does not say when to call it, what an evidence boundary means in practice, or how the output should be used in a security assessment. Barely adequate for the tool's complexity.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool takes zero parameters and the schema has an empty properties object, so there is no parameter semantics for the description to explain. Per the zero-parameter baseline, a 4 is appropriate. Nothing is missing on this dimension because there is nothing to disambiguate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description gives a verb ("Describe") and lists four facets it covers: scope, evidence boundary, inputs, and outputs. But it never states whose scope or what object is being described, so an agent must infer from the name that it introspects the agent/assessment itself rather than the surrounding system. Purpose is implied rather than stated, which is the definition of a vague 3.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no when-to-use guidance and no mention of the sibling tools (security_preflight, get_security_receipt, scan_source, screen_injection) that an agent must choose between. It does not say whether this should be called before or after a security assessment begins, nor what a caller gains by invoking it. The reader is left to infer all routing decisions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnly, idempotent, non-destructive, and closed-world. The description adds genuinely new behavioral context: the payload is unsigned and filtered, so it must not be treated as signature-verified, and the original delivery should be retained. It stops short of saying what the filtering strips out.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

A single compact sentence with no filler, front-loading the read nature and folding in the integrity caveat. It is tight but slightly clipped, and 'retain original delivery' is terse enough to require interpretation.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return values need no explanation. However, for a tool that returns deliberately filtered, unsigned data, the description omits what is filtered out and says nothing about how to supply receipt_id, leaving real gaps for a one-parameter lookup tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% and the single parameter, receipt_id, gets no format, origin, or lookup guidance in the description. With one undocumented parameter, the description fails to compensate for the schema gap.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description says it reads an 'unsigned, filtered public view,' implying a read of a receipt, but never names the resource being read; the agent must rely on the tool name and title ('Filtered public security receipt') to know what it retrieves. It also gives no contrast with siblings such as security_preflight.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is an implicit warning — keep the original delivery for signature verification — which hints this view is not authoritative. But there is no explicit when-to-use, when-not-to-use, or named alternative, and nothing tells the agent when to call this versus security_preflight or scan_source.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=false and destructiveHint=false, and the description adds real substance beyond that: hard input bounds (64 KiB, 2000 lines, 4096 chars/line), explicit non-behaviors (no model calls, no repo fetching, no code execution), and the nature of the response (a redacted signed receipt). The non-readonly hint is consistent with producing a signed receipt artifact rather than contradicting the text. It stops short of 5 because the 'verified fixed-order session' requirement is stated opaquely rather than explained.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The purpose is front-loaded in the first clause, followed by preconditions and then limits, with no filler sentences. Density is high but several tokens ('$1', 'VulnCanon', 'checkout caller') are undefined jargon that cost clarity rather than word count.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so the description need not explain return values, and the mention of a redacted signed receipt is a useful bonus. For a tool with three undocumented parameters, a mutation-adjacent annotation profile, and four similar security siblings, however, the missing parameter meanings and sibling routing make it only minimally complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% across three parameters, so the description must carry the full burden and largely fails to. 'The checkout caller and verified fixed-order session' gestures at agent_id/session_id but does not say which parameter maps to what, whether session_id is optional, or what 'source' should contain. An agent still cannot construct a valid call from this text plus the bare schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description gives a specific verb and resource ('inline VulnCanon source scan') plus a scope caveat ('indicators, not proven exploits') that sets expectations about output quality. It is distinguishable from siblings like screen_injection and security_preflight by being an inline source scan rather than a preflight or injection screen. Jargon ('$1', 'VulnCanon', 'fixed-order session') keeps it short of a 5.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

A prerequisite is stated ('Direct MCP requires the checkout caller and verified fixed-order session'), which implies when the tool can be invoked. However, there is no explicit guidance on when to choose this over screen_injection or security_preflight, and no when-not-to-use condition is given. The agent must infer routing from the sibling names alone.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Adds real context beyond the annotations: the $1 charge, the batch and payload caps, the session-verification prerequisite, and the important caveat that results are heuristic indicators rather than calibrated probabilities or a safety guarantee. It also clarifies no model calls or automatic follow-on purchase occur. It does not explain why readOnlyHint is false for what reads like a screening operation (presumably billing/session state).

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Compact and front-loaded with the batch scope, but it opens with a bare '$1' and uses opaque jargon ('checkout caller', 'verified fixed-order session') that forces the agent to guess at meaning. No sentence is pure filler, but several are cryptic rather than economical.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return values need not be described, and the cost/caps/caveats cover most operational concerns. What remains missing is the meaning of agent_id and the required/optional status of session_id — material gaps for a tool whose call will fail if those are supplied wrongly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% across three parameters, so the description must carry the load. It partially documents 'texts' (1–20 samples, 64 KiB total cap) but says nothing about agent_id, and only obliquely gestures at session_id via 'verified fixed-order session' without stating whether it is required or optional.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource: screening a batch of 1–20 text samples for 'deterministic injection markers'. An agent can tell this is text-content screening rather than source scanning, though the description never names scan_source or security_preflight to make the boundary explicit.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

It supplies hard preconditions (Direct MCP requires the checkout caller and a verified fixed-order session, max 64 KiB total, 1–20 samples) but gives no explicit when-to-use vs. when-not guidance relative to the sibling tools like scan_source or security_preflight. Usage is implied by the constraints rather than stated as routing advice.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations declare readOnlyHint=false, openWorldHint=false, idempotentHint=false and destructiveHint=false; the description adds real context on top — the $1 charge, the signed-receipt output, and confirmation that nothing is fetched over the network, which corroborates openWorldHint=false. It also discloses the auth prerequisite (checkout caller plus verified session) and that importing the receipt is a separate explicit action. It stops short of saying whether repeat calls re-charge or whether a payment_ref makes calls idempotent, which is the main remaining behavioral unknown.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loading the core action plus cost and return value is good structure, and the negative scope sentence earns its place. But phrases like "checkout caller and verified fixed-order session" and "x402 HTTP rail retains its existing introductory quote policy" are unexplained jargon that an agent cannot act on. Roughly a third of the text is internal billing lore rather than invocation guidance.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return values need not be described, and the cost and network-boundary disclosures are valuable for a non-read-only, 8-parameter tool. What's missing is the shape and purpose of the primary inputs (manifest, policy, sample_inputs, subject_profile_sha256) and any statement of what a rejection looks like. Complete enough to understand the transaction, incomplete for actually constructing a call.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% across 8 parameters, so the description carries the full burden and mostly doesn't: only session_id and payment_ref get indirect meaning via "checkout caller and verified fixed-order session" and the x402/quote sentence. The required agent_id and manifest, plus policy, sample_inputs, subject_profile_sha256, and request_id, receive no explanation of format, expected structure, or effect. Nested manifest/policy objects are especially opaque since both are additionalProperties-only.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The first sentence gives a verb and object ("Run a $1 static Security Preflight and return a signed receipt"), which conveys the core action and that it is paid and produces an artifact. However, "Security Preflight" is a product-specific term with no plain-language expansion, and the description never distinguishes this tool from siblings like scan_source, screen_injection, get_security_receipt, or describe_agent. An agent knows roughly what happens but not how it differs from the adjacent tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is implied rather than stated: direct MCP calls require a checkout caller and verified fixed-order session, and the final sentence clarifies that importing the receipt elsewhere is a separate action. The negative boundary "No deployed endpoint is fetched or tested" hints at when a live scan tool would be appropriate, but no sibling is named as an alternative. This is implied usage, not explicit when/when-not routing.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.