Kestrova: Solidity Vulnerability Scan

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and openWorldHint=false, so safety is covered. The description adds that the call is free and enumerates the returned fields, which partially compensates for the absent output schema, but says nothing about output format, units, or freshness of the terms.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short fragments, front-loaded with the key fact ('FREE') that an agent decides on. It is terse to the point of being clipped, but no sentence is wasted.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a zero-arg read-only tool the description covers the essentials — cost and returned fields — especially with no output schema. It still leaves ambiguous whether the returned 'how to pay' is instructions versus a transaction object, and whether the terms are static or per-request.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool takes zero parameters, so the baseline is 4; the schema adds nothing and the description correctly implies no inputs are needed.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description names what information is returned (price, recipient, network, asset, payment method) and ties it to the sibling scan_solidity_full, which is useful. However there is no verb stating what the tool actually does (e.g., 'returns payment details'), so the agent must infer that calling it yields those fields.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

'FREE' signals there is no cost to calling it, and naming scan_solidity_full implies this is a prerequisite lookup for that tool. But the relationship is only implied — there is no explicit 'call this before invoking scan_solidity_full' or exclusion of when not to call it.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations only declare readOnly/idempotent/closed-world; the description adds the whole payment contract: $1.00 USDC on Solana via x402, the _meta['x402/payment'] key, that an unpaid call returns payment terms and performs no scan or charge, and that charging happens only after a successful scan. That is exactly the kind of behavior an agent cannot infer from structured fields.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with the most decision-relevant fact (OPTIONAL, PAID $1.00), then payment mechanics, then the safety instruction. Dense but every sentence carries information; the parenthetical pricing detail is appropriately placed.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Covers cost, payment precondition, failure mode, output shape, and authorization policy for a paid tool with no output schema. The gap is input format for 'sources', plus no mention of rate limits or how findings are ordered when there are many.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% and the single required parameter 'sources' is a nested object mapping strings to strings. The description never says what sources should contain (file path to Solidity source text?) or how multi-file projects are keyed, so the one parameter remains opaque despite being the only input.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a specific verb/resource pair ('Structured Slither findings for Solidity') and enumerates the output fields (detector, impact, confidence, description, file/line). It signals the paid/full variant against the sibling scan_solidity_preview only implicitly via 'OPTIONAL, PAID' and the tool name, without ever naming the sibling.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

It does state key usage constraints: only pay with the user's explicit authorisation and within their spending limits, and that it is optional. But it never says when to prefer the free preview or payment_terms instead, so the routing decision between the three siblings is left to inference from the names.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Goes well beyond the annotations: discloses the underlying engine (Slither), the return shape, a hard input cap (max 60 kB), per-client rate limiting, and a false-negative caveat. The readOnly/idempotent hints are consistent with a pure analysis call, and the added operational constraints are exactly the kind of context annotations cannot carry.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loads what it is and that it is free, then detection scope, then usage timing, then the input contract and limits. Every clause carries information; nothing is repeated from the schema or title.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

No output schema exists, and the description covers the essentials: return values (severity counts plus High/Medium detector names), input format, size and rate limits, and the reliability caveat. An agent has everything needed to decide, call, and interpret the result.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 0% schema description coverage on a nested one-parameter object, the description fully compensates: it gives a literal example, '{"sources": {"File.sol": "<source>"}}', clarifies that imported files must be included, and states the 60 kB total limit. An agent can construct a valid call without guessing.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('FREE Solidity security check (Slither)') plus the exact class of findings it detects and the shape of the result (severity counts, High/Medium detector names). The 'FREE'/'preview' framing implicitly signals a lighter-weight sibling but never names scan_solidity_full, so sibling differentiation is inferred rather than stated.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives a clear lifecycle trigger: 'Use after writing or changing a contract and before deployment.' It also sets an important expectation boundary with 'Zero findings does not mean safe.' It stops short of explicitly routing to scan_solidity_full for deeper coverage, which is the one alternative an agent would want to know about.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.