generate_security_hardening

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description must carry the full behavioral burden. It states it generates snippets, but does not disclose the output format (e.g., list vs. single string), whether it is purely advisory or writes files, or any side effects. It also fails to mention any prerequisites or error conditions, leaving significant behavioral ambiguity for a generation tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, information-dense sentence. It front-loads the primary action and enumerates examples without waste, making it highly efficient and scannable.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple tool with one parameter and no output schema, the description covers the core purpose and the parameter's role. It mentions the types of snippets generated, which is adequate for most invocation scenarios. However, it omits details about the exact shape of the return value (e.g., array of snippets vs. combined code blocks) and any limitations, so it is not fully complete, but sufficient for a straightforward generation tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema describes target_stack with a clear enum and description, so coverage is 100%. The tool description adds no additional parameter semantics beyond what the schema already conveys; the baseline of 3 applies because the schema does the heavy lifting.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb (generates), a clear resource (production security hardening code snippets), and enumerates concrete security measures (CSP headers, rate limiting, JWT rotation, input sanitization). This clearly distinguishes it from sibling tools like audit_security_vulnerabilities (audit vs. generate) and other blueprint generators focused on different domains.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage when security hardening code is needed for a specific stack, but does not explicitly state when to use it over alternatives like audit_security_vulnerabilities or other generation tools. It lacks exclusions or alternative conditions, leaving it to inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.