websex_http_intruder

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations exist, so the description carries the full disclosure burden. It hints at boundedness ('caller-bounded') and a single insertion point ('sniper-style'), but says nothing about auth/session prerequisites, side effects, rate limits, or whether requests are recorded in the session. For a tool that fires many outbound HTTP requests, this is a significant gap.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

A single front-loaded sentence with no filler. Its only weakness is that the terseness is underspecification rather than genuine economy given the ten-parameter surface.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return values need not be described, but the tool still requires 8 of 10 params with zero documentation and no annotations. The description is too thin for an agent to safely wire up an intruder run against a session.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0% across 10 parameters, so the description must compensate and largely does not. It loosely maps to 'location'/'parameter' ('one query, header, body, or path location') and 'max_requests' ('caller-bounded'), but leaves engagement_id, session_id, method, url, headers, body, and payloads entirely unexplained.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb+resource: 'run sniper-style payload iteration through an HTTP workbench session' and names the injection targets ('query, header, body, or path location'). An agent can grasp the core operation, but the description never distinguishes it from close siblings like websex_ffuf, websex_wfuzz, or websex_api_fuzz.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

No when-to-use or when-not-to-use guidance is given, and no alternative is named despite several near-equivalent fuzzing/intruder siblings. The word 'sniper-style' implies a single-position insertion, but the description never tells the agent why to pick this over websex_ffuf or websex_http_repeater.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.