tollbooth-oauth2-collector

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full behavioral burden. It usefully discloses that the payload is a pending-code count plus a TTL, but never states that this is a non-mutating read, whether any auth is required, or how the TTL is defined — modest context for a read-only tool whose risk profile is low.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

A single front-loaded clause with no filler — the identity and payload are stated immediately. It could be marginally tighter by disambiguating 'TTL' (TTL of what: the codes, the collector, a cache?), which leaves a small ambiguity in an otherwise efficient sentence.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With an output schema present, the description does not need to explain return values, and the parameterless schema needs no parameter prose. What remains missing is the routing information against 'service_status' and any read-only/auth context, so it is adequate but not complete for an agent choosing between the two status siblings.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool takes no parameters (0 params, additionalProperties false), so there is nothing for the description to disambiguate; the baseline for a parameterless tool is 4.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb/resource pairing ('Health check') and names exactly what it reports: pending authorization code count and TTL. It is clear what the tool does, but it does not distinguish itself from the sibling 'service_status', which from the name alone could plausibly be the same kind of health check.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no explicit when-to-use statement and no mention of alternatives, despite 'service_status' being an obvious candidate for confusion. At best the phrase 'Health check' weakly implies a monitoring use case; nothing tells the agent when to call this versus the other status-style sibling.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden and does much of it: it discloses that the read is one-time and the stored code is auto-deleted, and that the returned value is encrypted and must be decrypted with the same state token. It omits permission/auth requirements and the failure mode when the code is absent or already consumed, which matters for a destructive-on-read operation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short sentences, zero filler, and the most decision-relevant fact (one-time read, auto-deleted) is front-loaded in parentheses. Every clause adds information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists so return-value explanation isn't needed, and the single parameter is fully documented. The remaining gap is failure behavior (already-retrieved or missing code) and any auth prerequisite, which a caller of a self-destructing read would want to know.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3, but the description adds real meaning: the same state token used to file the code is also the decryption key for the returned payload. That is a semantic detail not spelled out in the schema's field description, which only describes where the code was filed.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Retrieve a stored authorization code') plus its defining lifecycle trait ('one-time read, auto-deleted'). It implicitly contrasts with the write-side sibling store_code via 'pick up the code', but never names that sibling explicitly, so the differentiation is inferred rather than stated.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives a clear trigger condition: called by the originating MCP server after the user has authorized in the browser. That tells an agent the calling context well. It does not state what to do if the code was already consumed, or what alternative to consult instead (e.g., collector_status), so no explicit exclusions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden and does well: it discloses that the service is unauthenticated, free, has no operator runtime, and that vault/courier/operator fields are False/empty by construction. It also names the load-bearing return field, though it omits side-effect/rate-limit framing beyond the implied read-only nature.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The first sentence front-loads the purpose well, but the following paragraphs are dense and somewhat verbose for a no-parameter status collector, with implementation detail (backticked field names, envelope provenance) that partly duplicates what the output schema conveys.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Because an output schema exists, the description needn't enumerate return values, and it covers purpose, usage context, auth posture, and the key field. It is complete enough to call correctly, with only minor gaps around output interpretation beyond the highlighted sha.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool takes zero parameters, so there is nothing to document and the baseline is 4. The description correctly adds no parameter detail because none exists.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource — 'Report the running build' — and clarifies it delegates to the canonical build_service_status envelope, so an agent knows exactly what it returns. It does not explicitly differentiate from the sibling collector_status, which is the main gap keeping it from a 5.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives a clear use context: verifying that a redeploy landed the merged sha, as read by the post-merge deploy-verify probe. That tells the agent when this tool is the right one, but no alternatives or exclusions are named.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the behavioral burden and does well: it explains that the code is sealed with NIP-44 to the operator, that state carries the patron npub, operator npub, and one-time secret, and that the Neon row is keyed in a way that only the correct flow can find it. It does not discuss duplicate-row handling, overwrite behavior, or failure modes, which are the main remaining transparency gaps for a storage operation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The purpose is front-loaded in the first sentence, and the remaining sentences add relevant security and storage context. The description is dense and somewhat long, but most of its detail earns its place by explaining the sealing and keying model.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a security-sensitive write operation with no annotations, the description is substantially complete: it covers purpose, callback usage, sealing, state contents, and row-key isolation. Since the input schema is fully documented and an output schema exists, the main minor omissions are duplicate handling and error behavior rather than core invocation semantics.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is already 100%, so the baseline is 3, but the description adds substantial meaning beyond the schema by explaining what the packed state contains and how it controls sealing and row lookup. It reinforces the security semantics of both parameters rather than merely restating their types.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource: 'Store a sealed OAuth2 authorization code.' It clearly distinguishes the write-side operation from the sibling retrieve_code tool and explains the callback context in which storage happens.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives clear usage context by saying this is called by the serverless callback function after the browser redirect. It does not explicitly name retrieve_code or state when not to use this tool, but the operational context is specific enough for an agent to select it correctly.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.