Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already indicate the operation is non-read-only and non-destructive, but the description adds the authorization boundary ('Owner-only'), the rotation policy ('when explicitly requested'), and a security handling rule ('Keep the secret private'). This is meaningful behavioral context beyond the annotation flags, though rotation side effects are not detailed.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is only two short sentences with no filler. It front-loads the primary action and each clause adds necessary context about scope, behavior, or confidentiality.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With an output schema present and only three scalar parameters, the description covers owner-only access, the retrieve/rotate operations, and secret sensitivity. However, it does not clarify the required parameters or the effects of rotation, leaving a moderate completeness gap.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, and the description does not explicitly explain agent_id, api_key, or rotate. The phrase 'when explicitly requested' only loosely hints at the rotate parameter, leaving the meaning of the other parameters to be inferred from their names.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses specific verbs, 'retrieve' and 'rotate', with a clear resource, 'webhook signing secret', and an explicit owner-only scope. It is easy to distinguish from sibling health/domain tools because the resource and operation are different.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description clearly states the two relevant use cases: retrieving the secret or rotating it only when explicitly requested. It also provides the owner-only restriction and a privacy directive, though it does not explicitly name alternatives or when not to use this tool.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.