Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Adds real behavior beyond the annotations: Mozilla may serve a reused recent scan rather than re-fetching, and the tool is keyless (no auth). It also discloses the return shape, which matters since there is no output schema. It does not cover latency, failure modes, or rate limits, so it falls short of a 5.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loads the action and return values, then the authoritative claim, the caching caveat, and the routing hint in a tight sequence. Slightly dense with quoted phrases and emphasis caps, but every clause carries information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description correctly compensates by naming the return fields (letter grade, numeric score, tests passed), and it discloses the caching and keyless behavior. Adequate for a single-parameter read tool, though failure modes for an unreachable or ungraded host are unaddressed.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% and the schema already explains the host format including URL reduction, so the description contributes nothing additional about parameters. Baseline 3 is appropriate when the schema carries the full burden.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

Names a specific verb (Scan) and resource (a website's HTTP security headers) and states exactly what is returned: letter grade, numeric score, and count of Mozilla's 12 tests passed. It also distances itself from the sibling tools observatory_results and observatory_grade_distribution by scoping what it does and does not report.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly declares itself AUTHORITATIVE for "how secure are this site's headers" and "what is this domain's Observatory grade", then routes the agent elsewhere: "Use observatory_results for the per-test breakdown and fixes." The alternative is named with the condition that selects it, so no inference is required.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.