Check code for health-data mistakes

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and openWorldHint=false, so 'Runs on this machine; nothing is uploaded' partly restates that, but the description adds genuinely new behavioral context: the scan is restricted to a fixed checklist and a clean result is explicitly not proof of compliance. That caveat is the kind of thing an agent cannot infer from annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The purpose is front-loaded in the first clause, followed by evidence, a privacy note, a usage hint, and a return-value summary. The enumerated mistake list is long but each item is substantive; the only mild redundancy is the local-execution statement overlapping with openWorldHint.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description explains the return shape ('each finding with its file, line, a plain explanation and a suggested fix'), covers invocation context, privacy behavior, and limitations. An agent has everything needed to call it and interpret results.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, with files, paths, and allowed_hosts all documented in the schema itself, so the baseline of 3 applies. The description mentions none of the parameters (e.g. it never says paths and files can be combined, nor how allowed_hosts affects the network-request findings), so it adds nothing beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a specific verb and resource ('Checks web code for common mistakes with patient or health data') and then enumerates the exact class of findings it produces, so an agent knows precisely what the tool does without opening the schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

It states a clear usage context ('Useful after writing or changing code that handles health information') and a scope boundary ('a clean result is not a compliance review'). It doesn't name an alternative tool, but there are no siblings to distinguish from, so this is close to complete guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.