update_oauth_client

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

This description goes well beyond the annotations. It discloses that scope_codenames replaces rather than augments, that narrowing scopes only affects future tokens, that existing tokens keep their scopes, that the secret is unchanged and not returned, and that narrowing alone is insufficient after a leak. These are exactly the behavioral nuances an agent needs and are not visible from the input schema or annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well organized and front-loaded with the core purpose, then covers id provenance, scope replacement behavior, security implications, parameter exclusivity, secret handling, and required permissions in a logical order. Every sentence carries critical information; the length is justified by the number of non-obvious behavioral caveats.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a mutation tool with six parameters and subtle side effects, the description is remarkably complete. It covers authentication requirements, data sources, replacement semantics, timing of effects, security escalation guidance, and separation from secret rotation. Since an output schema exists, there is no need for the description to detail return values, and nothing essential is left for the agent to guess.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With schema description coverage at 0%, the description carries the full semantic burden for parameters. It explains how to obtain id, the replacement semantics of scope_codenames, how to combine it with get_oauth_client output, and the mutual exclusivity of scope_codenames and scope_preset. It also clarifies that the secret parameter is not part of this operation even though the tool is a client-update mutation.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a precise statement: 'Change an API client's name, description, scopes or IP allowlist.' This names the exact resource, the specific action, and the affected fields, which clearly distinguishes it from sibling tools like create_oauth_client, rotate_oauth_client_secret, and deactivate_oauth_client. The closing note that the secret is not changed here further prevents confusion with secret-rotation tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives concrete usage guidance: the id must come from list_oauth_clients, adding a scope requires reading the current set via get_oauth_client, and scope_codenames should be sent alongside the existing scopes to avoid removing them. It also states required permissions ('clients:write' scope and 'admin' capability), the exclusivity rule for scope_codenames vs scope_preset, and explicitly directs that secret-rotation and refresh-token revocation are needed when narrowing scopes due to a leak.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.