Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already establish read-only, idempotent, non-destructive behavior. The description adds useful context beyond that: the crack-time model assumption (ten billion guesses per second) and the type of weakness analysis performed. The 'never uploaded; assessed locally' guarantee in the parameter description further discloses privacy-relevant behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Two dense sentences with no filler. The purpose and output details are front-loaded, and the source link is appended without disrupting the useful content.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a single-parameter tool with an output schema and read-only annotations, the description is complete: it states what the tool does, what outputs to expect, the underlying assumption, and a reference source. Nothing necessary for correct invocation is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the single parameter is already documented in the schema. The main description does not add meaning about the input beyond what the schema's parameter description already provides, landing at the high-coverage baseline of 3.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource ('Estimate how strong a password is') and enumerates the concrete outputs: entropy bits, crack time, 0-4 score with verdict, and weak-pattern warnings. This makes the tool's function unambiguous and sets it apart from siblings like hash_generator.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The context is clear: this tool is for assessing password strength, and the described outputs make the use case obvious. It does not explicitly name alternatives or exclusion criteria, but no sibling tool competes for the same job, so the omission is minor.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.