Return before/after code examples for migrating a classical algorithm to a post-quantum / hybrid replacement. Provide an 'algorithm' (RSA, ECDH, ECDSA, …) or a 'ruleId' from a finding.
| Name | Required | Description | Default |
|---|---|---|---|
| ruleId | No | A finding's ruleId (resolved to its algorithm). | |
| algorithm | No | Classical algorithm family to migrate away from. |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the transparency burden. It states what the tool returns but does not disclose behavior around empty inputs or both parameters supplied. There is no mention of side effects or error handling, leaving some ambiguity.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences long, front-loaded with the verb 'Return', and contains no filler. Every clause adds value, making it highly efficient.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity (2 optional params, no output schema), the description is largely complete: it defines purpose, input, and output. It lacks explicit details about the precedence when both params are provided or behavior when neither is supplied, but these are minor gaps for a 'get examples' tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% for the two parameters, and the description adds little beyond the schema. It does provide examples of algorithms (RSA, ECDH, ECDSA) and clarifies the 'or' relationship, but the core meaning is already present in the schema, so it aligns with the baseline of 3.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool returns before/after code examples for migrating a classical algorithm to a post-quantum/hybrid replacement. It specifies the resource (code examples) and the action (return), distinguishing it from siblings like suggest_hybrid which likely recommends algorithms.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives clear usage context: provide an 'algorithm' or a 'ruleId' from a finding. This implies when to use the tool, but it does not explicitly mention alternatives or when not to use it, so it only meets the 'clear context, no exclusions' level.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Add one secure layer between your agents and this server.
Most tools target distinct parts of the PQC remediation workflow (explain, triage, fix, verify), but verify_fix and apply_verified_patch have overlapping purposes: both check code for remaining classical crypto. The latter adds patch-policy and blast-radius gates, making the boundary somewhat blurry.
All tool names follow a consistent verb_noun snake_case pattern (e.g., list_rules, triage_findings, verify_fix). There are no mixed conventions or unpredictable naming variations.
11 tools is well within the ideal range for a specialized toolkit. Each tool addresses a distinct step in the migration process: understanding, triaging, remediating, verifying, and scoring.
The set covers the core lifecycle: rule discovery, finding explanation, triage, remediation bundling, patch verification, and progress measurement. The only notable gap is that it relies on an external scan_path to provide findings—no scan tool is included—but this appears to be an intentional separation of concerns.