Run a registered tool and seal an ExecutionRecord (inputs, versions, output hashes).
Args:
tool: tool name from list_execution_tools
inputs: tool inputs (JSON object); stored verbatim so the run can be replayed
agent_id: calling agent or workflow identity
retrieval_ids: evidence retrievals this run was derived from, for provenance links
| Name | Required | Description | Default |
|---|---|---|---|
| tool | Yes | ||
| inputs | Yes | ||
| agent_id | Yes | ||
| retrieval_ids | No |
Changes observed during successful MCP inspections.
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations only give the generic write profile (readOnly=false, destructive=false, idempotent=false). The description adds real behavioral context beyond them: it seals a persistent ExecutionRecord, stores inputs verbatim so runs are replayable, records version and output hashes, and links provenance via retrieval_ids. It still omits failure behavior and whether the underlying tool's output is returned to the caller.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded purpose sentence followed by a compact four-line Args list; no filler. Slightly docstring-formatted rather than prose, but every line adds information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a mutation tool with no output schema, the definition covers persistence, replay and provenance but leaves gaps: whether the run's output (vs. only its hash) is returned, what happens on invalid inputs or unknown tool names, and any auth/identity requirements. Adequate but not complete for an audit-recording write operation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description carries the full burden and mostly delivers: tool is scoped to names from list_execution_tools, inputs is a JSON object stored verbatim for replay, agent_id is the calling identity, and retrieval_ids are provenance links, with optionality implied by the default null in the schema. It does not explain per-tool input shape validation.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ("Run a registered tool") and adds the consequential side effect: it seals an ExecutionRecord with inputs, versions and output hashes. It routes the agent to list_execution_tools for valid tool names, but does not distinguish itself from siblings like replay_execution, which also produce execution records.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is only implied: the agent must first have a registered tool name (via list_execution_tools) and, for provenance, retrieval_ids. There is no explicit when-to-use statement, no when-not-to-use, and no guidance on choosing this over replay_execution or verify_executions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Add one secure layer between your agents and this server.