websex_sqli_probe

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden, and it does disclose meaningful behavior: the oracle fires only when true matches baseline, false diverges, and control behaves like false. That reduces false positives. However, it says nothing about request volume implied by max_requests, auth/engagement scoping, follow_redirects effects, or whether the probe is otherwise passive/safe.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

One dense, front-loaded sentence with no filler — the detection mechanism and its trigger condition come immediately. It is compact, though the heavy em-dash clause compresses several ideas into a single run-on.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The existence of an output schema relieves the description of explaining results, and the core oracle logic is captured. But for an 8-parameter request-shaping tool with an engagement scoping field and zero parameter documentation, the definition is too thin to tell an agent how to configure the call.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% across 8 parameters, so the description must compensate — and it does not. It clarifies only that a single parameter is targeted; url, method, body, headers, engagement_id, max_requests, and follow_redirects all remain undocumented in both schema and description.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific technique and resource: a Boolean-differential SQLi oracle targeting one parameter, which distinguishes it from the time-based sibling websex_sqli_time_probe. The mechanism (true/false/control triplets) makes the purpose unambiguous, though it never names an alternative tool directly.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explains the firing logic but gives no when-to-use guidance — nothing about preferring this over sqlmap, sqli_time_probe, or api_fuzz, and no prerequisites (e.g., needing a stable baseline response). An agent must infer applicability entirely.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.