Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare openWorldHint=true, readOnlyHint=false and idempotentHint=false, but the description adds genuinely new behavioral facts: the scan is rate-limited, it opens an external connection, and it stores a publicly accessible result — a non-obvious privacy/data-persistence consequence. It also enumerates what is returned (observation_status, measured time, negotiated group, certificate summary), which matters since no output schema exists. It stops short of stating auth requirements or how rate limiting manifests (errors vs. throttling).

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Four short sentences, front-loaded with the action and immediately followed by the return payload and then the behavioral caveats. Nearly every clause earns its place; only the port-443 restatement slightly duplicates the schema.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a one-parameter tool with no output schema, the description covers action, return fields, rate limiting, external connection, public result storage, and scope limits — enough for correct invocation. It leaves out failure behavior (invalid hostname, rate-limit rejection) and any latency expectation, which are the only material gaps.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% for the single 'domain' parameter, and the schema already specifies 'Public DNS hostname, for example example.com. HTTPS port 443 only.' The description repeats the public-hostname and port-443 constraint without adding format or validation detail, so the schema is doing the work and the baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description gives a specific verb and resource: 'Run a new, rate-limited TLS scan of a public hostname on port 443.' The word 'new' plus the enumerated return fields makes it distinguishable from retrieval siblings such as get_tls_evidence and get_example_result, and the closing scope line ('Does not judge application safety') bounds what it is not.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is only implied: 'Run a new' suggests this is the tool for producing a fresh measurement rather than reading existing evidence, and the port-443/public-hostname constraints implicitly exclude internal targets. However, no sibling is named, and there is no explicit statement of when to call this versus get_tls_evidence or when a full report order is warranted.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.