Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=false, destructiveHint=true, idempotentHint=false, and openWorldHint=true. The description adds useful behavioral context: it enforces scope, call/credit budget, billing, and server-side credential injection, and notes that writes require idempotency_key. However, it does not detail what happens on budget exhaustion, how errors are surfaced, or the nature of the destructive behavior. It does not contradict annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences and front-loads the core action and constraints. It is concise and every sentence adds information. However, it could be slightly more structured by separating the write requirement from the general behavior.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (7 params, anyOf alternatives, enums, no output schema, destructive annotation), the description is incomplete. It does not explain the two invocation modes (operation+input vs target), how to choose between them, what the response looks like, or how failures/budget issues are reported. The annotations cover safety but not operational semantics.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is only 14%, so the description must compensate for undocumented parameters. The description only mentions idempotency_key for writes and capability as a scoped credential. It does not explain the distinction between operation+input and target, the role of method, body_json, or how the anyOf alternatives should be chosen. This is a significant gap for a 7-parameter tool.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb ('Call') and resource ('an allowed provider operation with a capability'), and clarifies that it enforces scope, budget, and billing before credential injection. It does not explicitly differentiate from siblings like xguard_execute, but the mention of 'secretless' and capability-based invocation gives reasonable clarity.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage context: use this tool to call provider operations with a capability, and mentions that writes require idempotency_key. However, it does not explicitly state when to use this tool versus xguard_execute or xguard_preflight, nor does it provide exclusions or alternatives. The sibling names suggest related tools, but no routing guidance is given.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.