Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint, idempotentHint, and destructiveHint, covering the safety profile. The description adds meaningful behavioral context by specifying that an OAuth bearer token linked to an active HIBP API subscription is required, which is critical for invocation. It also mentions the ability to refine results via filters. No contradiction with annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is only two sentences, with the core purpose front-loaded in the first sentence. Every clause earns its place: the purpose, the auth requirement, and a refinement guideline. There is no filler or repetition of schema details, making it appropriately concise.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the output schema exists and annotations cover the non-destructive, idempotent behavior, the description doesn't need to repeat those. It supplies the auth requirement, which is essential for correct invocation, and parameter refinement hints. It doesn't mention rate limits or empty-result behavior, but those are not strictly necessary for tool selection and invocation. The only notable omission is explicit routing among the crowded sibling list, which is better handled in the usage guidelines dimension.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the baseline is 3. The description adds a slight hint about using 'domain and verification filters' to refine results, but the phrase 'verification filters' is somewhat vague and doesn't map cleanly to the includeUnverified parameter (which defaults to true, meaning unverified breaches are included rather than filtered out). Overall, the description adds minimal semantic value beyond the already-rich schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb and resource: 'Search HIBP for breaches affecting a single email address.' The 'single email address' qualifier clearly distinguishes it from sibling tools like hibp_get_breached_account_range and hibp_get_breached_domain. This gives the agent a precise, actionable purpose without opening the schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The context is clear: this tool is for searching breaches for one email address, so the primary use case is evident. It also provides refinement advice ('use domain and verification filters to refine the result'), but it does not explicitly name alternatives or state when not to use this tool in favor of a specific sibling. Since the intent is implied rather than exclusionary, it falls just short of a 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.