gap_analysis

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The [READ] marker aligns with readOnlyHint=true, and the description adds real value beyond annotations: it discloses the return shape (reason + remediation per control) and a methodological caveat that audit trails evidence operating effectiveness strongly but control design only partially. That caveat is genuine behavioral context an agent cannot get from the annotation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loads what the tool returns, then the caveat, then a compact Args block. Every element earns its place with no filler, though the trailing arg list is slightly clipped in style.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

No output schema exists, so the description carries the return-value burden, and it does so by describing what each gap entry contains. Combined with the readOnlyHint annotation and documented args, it is nearly complete; the main omission is explicit sibling routing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0% – the schema gives no enum and no descriptions – so the description must compensate, and it does: it enumerates the framework values (hipaa/pci_dss/soc2/gdpr) and defines since/until as ISO timestamps bounding the period. This meaningfully exceeds the bare schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource: it surfaces controls with no/weak evidence and returns an honest reason plus remediation. This differentiates it from siblings like coverage_summary and control_evidence. It stops short of naming a sibling explicitly, keeping it at a strong 4 rather than 5.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage (finding compliance gaps) but never states when to pick this over coverage_summary, control_evidence, or exceptions_report. No when-to-use or when-not guidance is given, so the agent must infer the routing itself.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.