audit_graph

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the behavioral disclosure burden and does add value: it reveals that auth detection is heuristic, based on dependency names, auth Header params, and calls to auth-like functions, and that the optional parameter extends those heuristics. It implies a read-only static-analysis tool, though it does not state the return format or side effects explicitly.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Three dense sentences: the first lists the audit scope, the second explains the auth inference mechanism, and the third tells how to extend it with custom guard functions. There is no filler, redundancy, or restatement of the tool name.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a multi-category audit tool with no annotations and no output schema, the description covers what is checked and how auth detection behaves, which is enough for an agent to decide whether to call it. It could improve by describing the shape of the returned report and the expected value of project_root, but these are moderate gaps.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The description goes beyond the schema by explaining that auth_dependencies declares function names for custom guards the heuristics miss. project_root is not described in detail, but 'project-wide checks' plus the parameter name make its role reasonably clear; the parameter surface is small even though schema description coverage is 0%.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description states that the tool performs project-wide audits and enumerates concrete check categories (authless write routes, duplicate routes, unmounted routers, unused schemas, unreferenced ORM models, dependency cycles, parse errors), so an agent can tell this is a broad analysis/audit tool rather than a single lookup. It does not explicitly contrast itself with overlapping siblings like list_routes or build_dependency_graph, so it stops short of full differentiation.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The enumerated check types make it clear the tool is for project-wide audits rather than single-target lookups, and the second paragraph explains when to pass auth_dependencies for custom auth guards the heuristics miss. It provides clear usage context but no explicit when-not-to-use guidance or routing to an alternative sibling.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.