auth_passkey_authentication_verify

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It discloses nothing about side effects, session/token issuance on success, failure behavior, or authentication requirements beyond the word 'Verify'. The only behavioral hint (the 'confirm' parameter's non-GET preview behavior) comes from the schema, not the description.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The text is short but padded with non-earning content: the HTTP method/path echo and 'Tags: Auth Controller' are mechanical filler that do not help an agent invoke the tool. What little remains is not front-loaded with the operationally useful information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a two-step passkey authentication flow with a nested WebAuthn response object, no output schema, and no annotations, the description leaves the agent without enough context to call it correctly. It neither explains the expected credential/response shape nor the sequence relative to its siblings.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is only 50% and the critical nested 'body'/'response' parameter is entirely undocumented (no type or description) in both schema and text. The description adds zero parameter meaning, so it fails to compensate for the coverage gap.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a recognizable verb and resource ('Verify the authentication for passkey'), so an agent can tell roughly what it does. However, it does not differentiate from closely-related siblings such as auth_passkey_authentication_options or passkey_passkey_registration_verify, and the leading 'POST /api/auth/passkey/authentication/verify' line is mechanical path echo rather than added meaning.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no indication of when this tool should be invoked versus the options-generation or registration siblings, nor any stated precondition (e.g., that it must follow a prior authentication-options call). Usage is only weakly implied by the verb 'Verify'.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.