mobile-re-mcp

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description must carry behavioral disclosure, and it does reveal the two-phase nature (decompile, then extract) and the two output shapes. It omits important operational context: external dependencies such as apktool/Java, expected runtime on large APKs, and what happens when no annotations are found or the APK fails to decompile.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, zero filler, with the primary action and data source front-loaded and the output described last. Nothing is repeated and nothing needs trimming.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

No output schema exists, but the description still names both return shapes, which is what an agent needs to pick an output_format. Combined with full schema coverage of inputs, the definition is sufficient to invoke the tool correctly, though a note about apktool prerequisites would be a bonus.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so all three parameters are already documented, including the txt/postman enum. The description only echoes the output_format choice ("list of API endpoints or a Postman collection") without adding format details, and says nothing about the apk_path vs smali_folder tradeoff beyond what the schema states.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb chain (decompile, extract) plus the exact resource (Retrofit HTTP annotations and OkHttp3 endpoints from smali bytecode), which no sibling tool covers — siblings handle manifests, permissions, secrets, and frameworks. An agent can tell this is the endpoint-extraction tool without opening the schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The purpose implies when to use it (you want API endpoints from an Android app), but there is no explicit when/when-not guidance and no sibling or alternative is named. The description never mentions that callers can either supply an APK or a pre-decompiled smali folder, leaving that routing decision entirely to the schema.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description must carry the behavioral burden. It usefully discloses the extraction sequence, including google-services.json parsing and resource.arsc scanning with the strings command, but it omits whether the tool only reads, whether it writes any files, how missing files are handled, and what the overall return format is.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Three compact sentences are front-loaded with the core purpose and then detail the extraction modes. Every sentence contributes useful information with no filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

There is no output schema and no annotations, so the description should be richer about return values and failure behavior. It explains the input modes and one structured output case, but not the full output shape or what happens when google-services.json is absent.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3. The description adds meaning beyond the schema by explaining the behavioral effect of smali_folder: it causes direct parsing of res/values/strings.xml for structured key=value output.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource: extracts Google and Firebase configuration from an APK. It also names the exact artifacts it examines, which distinguishes it from iOS siblings and from broader Android secret scanners.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is implied by the tool name and the APK-specific scope, and the optional smali_folder condition is given. However, the description does not explicitly say when to use this instead of android_secrets_scanner, android_api_extractor, or apk_manifest_analyzer, nor does it state exclusions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden; it partially does so by disclosing the concrete mechanics (strings on classes*.dex and resources.arsc, text asset scanning) and how behavior changes with smali_folder. It says nothing about return format, whether findings are deduplicated/rated, expected runtime on large APKs, or whether the APK is modified — all relevant for a scanner with no output schema.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, purpose front-loaded, then the mode-conditional behavior in a single parallel construction. No filler and nothing repeated from the schema.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 3-parameter tool with no annotations and no output schema, the description should say something about what findings look like (fields, confidence, format). It covers method and scope well but leaves the entire result contract unstated.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so apk_path and min_length are already documented by the schema; the description adds real semantic value only for smali_folder by explaining it must be apktool output and how presence changes the scan strategy. min_length is never referenced in the description, so it adds no coverage beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb+resource ('Scans an APK for hardcoded secrets and API keys') and implicitly separates itself from the iOS sibling by naming APK as the target. An agent can tell immediately this is the Android secret-scanning tool, not the API extractor or manifest analyzer.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The with/without smali_folder split gives explicit conditional guidance on which mode applies depending on whether apktool output exists, and it explains what each mode scans. It does not say when to prefer this over android_api_extractor or what happens if both a secrets scan and an API extraction are needed.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It discloses that the operation is a read/parse and what categories of data are surfaced, including security-relevant flags (exported, debuggable, allowBackup), but says nothing about failure modes (malformed/binary-encoded manifest), performance, or the shape of the result.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, front-loaded with the core action, then the payload enumeration. No filler and no repetition of structured fields.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a single-parameter read-only tool with no annotations or output schema, the description gives enough to know what it does and roughly what comes back. Missing: the result format (JSON tree vs. summarized report) and handling of edge cases, which would matter when the agent decides whether to call it or a sibling scanner.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Only one parameter (apk_path) and schema description coverage is 100%, with the schema already stating 'Absolute path to the APK file to analyze'. The description adds no further constraint or format detail beyond the schema, so baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (parses) and a specific resource (AndroidManifest.xml inside an APK), then enumerates the extracted elements: package info, activities, services, receivers, intent filters, and security flags. The Android/APK scope makes it distinguishable from ios_manifest_analyzer and apk_permissions_checker, though no sibling is named explicitly.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is only implied: an agent can infer this is the tool for static manifest inspection of an APK. There is no statement of when to prefer it over apk_permissions_checker or android_secrets_scanner, and no prerequisites (e.g. the APK must exist on disk, must be unzipped/parsed).

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden, and it does disclose the output categorization behavior (dangerous permissions separated). However, it omits whether the tool is read-only (implied but unstated), what happens if the APK is malformed, and what the response contains beyond the categorization.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, zero waste, with the core action front-loaded and the dangerous-permission detail as a follow-up clarification. Every sentence earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a single-parameter read-only analysis tool with no output schema, the description covers what it does and the shape of the key output (categorized, with dangerous ones flagged). A mention of failure modes or return structure would make it fully complete, but it is adequate as-is.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% and the single parameter 'apk_path' is fully documented in the schema, so the description adds no semantics beyond it. Baseline 3 applies when the schema does the heavy lifting.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Extracts and categorizes permissions requested by an APK') plus the notable behavior of highlighting dangerous permissions. It distinguishes itself implicitly from siblings like apk_manifest_analyzer and ios_permissions_checker, though it never names those alternatives explicitly.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no guidance on when to use this tool versus apk_manifest_analyzer (which likely also parses manifests) or the iOS counterpart. The agent must infer selection from the name alone; no prerequisites or exclusions are stated.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full behavioral burden. It discloses what classes of strings are returned but says nothing about whether the binary/IPA is modified (presumably read-only), how large binaries are handled, whether scanning is expensive, or what the response structure looks like — significant gaps for a binary-analysis tool with zero annotation coverage.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

A single front-loaded sentence that names the action, the target artifact, and the filtering behavior with no filler. Every clause earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With only three fully documented parameters and no output schema, the tool is simple enough that the description is close to sufficient. Still, it never characterizes the return value (a flat list of matching strings? grouped by category?) nor notes that the operation is read-only and non-destructive, which an agent must otherwise infer.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents ipa_path, filter enum values, and min_length bounds. The description's pattern list loosely maps to the filter enum but adds no syntax, format, or interaction details beyond what the schema states, making the baseline of 3 appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Extracts printable strings from an iOS app binary') and enumerates the pattern classes it surfaces, so the tool's function is unambiguous. It never names or contrasts itself with the very similar ios_secrets_scanner / android_secrets_scanner siblings, so sibling differentiation is left to the agent.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The security-analysis context is implied by the enumerated pattern types, giving an agent a reasonable sense of when to reach for it. However, there is no explicit when-to-use guidance and no statement of how it differs from ios_secrets_scanner, which appears to cover overlapping credential/secret detection.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations exist, so the description carries the full behavioral burden. It usefully discloses the mechanism (codesign) and the types of findings (get-task-allow, iCloud containers, keychain groups), but does not state that it is read-only static analysis with no side effects, nor how it behaves on malformed or unsigned IPAs.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Two tight sentences: what it does and what it surfaces. No filler, and the extraction method is front-loaded with the value proposition.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple one-parameter static analysis tool with no annotations and no output schema, the description covers the purpose and detection targets but says nothing about the shape of results (e.g., a list of entitlement key/value pairs) or failure modes, which an agent needs to interpret the call.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

There is a single parameter with 100% schema description coverage, so the schema already explains ipa_path as an absolute path. The description adds no semantics beyond that, which meets the baseline but does not exceed it.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (extracts/analyzes) and resource (entitlements in the iOS app binary) plus the mechanism (codesign). It does not explicitly differentiate itself from the close sibling ios_permissions_checker, leaving the entitlements-vs-permissions boundary to inference.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The mention of detecting 'dangerous entitlements' implies a security-audit use case, but the description never states when to pick this over ios_permissions_checker, ios_manifest_analyzer, or ios_secrets_scanner, nor any prerequisites or exclusions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full behavioral burden. It discloses useful output semantics (framework listing, category mapping, privacy highlighting), but it does not explicitly state that the tool is read-only, local/offline, or free of side effects, nor does it describe failure modes or exact return structure.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is three concise sentences with no wasted text. The primary action is front-loaded, followed by classification details and the privacy-relevant highlight.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple one-parameter static analysis tool, the description covers the main operation and the kind of output an agent can expect. It is slightly incomplete because there is no output schema and it does not clarify read-only behavior or exact output shape, but it is generally adequate.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

There is one required parameter and schema description coverage is 100%, with the schema already explaining that ipa_path is an absolute path to the IPA file. The description adds no parameter-specific detail beyond that, so it meets the baseline for high schema coverage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource: it lists third-party frameworks bundled inside an IPA, sourced from Frameworks/, and maps them to categories. This is clear enough for an agent to understand the tool's function, though it does not explicitly differentiate itself from siblings such as ios_binary_strings or ios_manifest_analyzer.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The mention of categorizing frameworks and highlighting privacy-relevant SDKs implies a use case for SDK inventory and privacy review. However, it gives no explicit guidance on when to choose this tool over related iOS analysis tools, and it names no alternatives or exclusions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are supplied, so the description carries the full burden. It does disclose meaningful behavior beyond the name: it parses a specific plist and additionally scans all text plist and JSON files in the IPA. However, it omits whether the scan is read-only (implied but not stated), how large/expensive the scan is, or what happens when no Google config exists.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Three tight sentences with the extraction target front-loaded, followed by the specific plist and the fallback scanning behavior. No filler, though the final sentence could be trimmed or merged to be maximally efficient.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With a single required parameter, no annotations, and no output schema, the description is nearly sufficient: it enumerates the exact fields returned (API key, project ID, database URL, storage bucket, GCM sender ID, OAuth client IDs), which compensates for the missing output schema. It only lacks guidance on result shape or handling of missing configuration.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Only one parameter and schema description coverage is 100%, so the schema already documents ipa_path as an absolute path. The description adds no further parameter meaning (no mention of accepting a directory, extracted bundle, or relative paths). Baseline 3 applies because the schema does the work.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource: extracts Google and Firebase configuration from an IPA, and names the concrete artifact it parses (GoogleService-Info.plist) plus the fields it pulls. This clearly separates it from android_google_services by platform, though it never acknowledges overlap with ios_secrets_scanner, which the 'pattern scanning' clause suggests.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is only implied — an agent can infer it should call this when analyzing an iOS app for Firebase/Google config. There is no explicit when-to-use statement, no prerequisites (e.g., the IPA must be unencrypted or extracted), and no pointer to ios_secrets_scanner or android_google_services as alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description must carry the behavioral load; it does add that the tool "highlights insecure configurations," which tells the agent to expect analytical output, not raw JSON. It says nothing about failure modes (missing/corrupt IPA), whether analysis is static-only, or the shape of results.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, zero filler, with the core action front-loaded and the extracted data listed second. Every clause earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a one-parameter read tool with no output schema, listing the extracted fields effectively communicates what comes back. Minor gap: no mention of error behavior or of how the "insecure configurations" findings are reported.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The single parameter has 100% schema description coverage ("Absolute path to the IPA file to analyze"), so the schema already does the work. The description adds no syntax, constraints, or path-handling detail beyond it — baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

Specific verb+resource: "Parses Info.plist from an IPA file" and enumerates the exact fields extracted (bundle ID, version, URL schemes, ATS settings, background modes). This clearly separates it from the APK-side siblings, though it never names which sibling to prefer among the many ios_* tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is strongly implied — you call it when you have an IPA and want manifest-level facts — but there is no explicit when/when-not guidance and no routing against close alternatives like ios_permissions_checker, ios_entitlements_checker, or ios_google_services.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full behavioral burden. It usefully discloses that the tool extracts data from Info.plist and categorizes permissions by risk level with explanations, but it does not explicitly confirm read-only behavior, error handling, or constraints such as malformed or encrypted IPA handling.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The definition is two tight sentences with no wasted language. The core extraction purpose is front-loaded, followed by the useful output detail about risk categorization.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple one-parameter read/analysis tool, the description covers the essential purpose and gives a meaningful preview of the return value even without an output schema. It is only slightly incomplete because it leaves behavioral constraints and explicit read-only semantics unstated.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The only parameter, ipa_path, is fully documented in the schema as an absolute path to the IPA file. The description adds no parameter-specific detail beyond the schema, so the baseline of 3 applies when schema coverage is complete.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a specific verb and resource: extracting privacy permission usage descriptions from an IPA's Info.plist, and it also states the output categorization. It is clearly distinct from adjacent iOS tools in substance, but it does not explicitly name a sibling or clarify when to choose it over ios_entitlements_checker or ios_manifest_analyzer.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides no explicit when-to-use guidance, prerequisites, or routing against alternatives. A reader can infer it is for iOS IPA permission inspection, but there is no stated condition for selecting it instead of sibling iOS analysis tools.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full behavioral burden. It usefully discloses the two-layer mechanism, including text resource scanning and binary extraction followed by the strings command. However, it does not state whether the operation is read-only, what kind of findings are returned, or any limitations such as false positives or performance considerations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two tightly structured sentences with zero waste. The core purpose is front-loaded, followed by the layered scanning mechanism.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description is adequate for understanding the scanning approach and the schema fully covers the two parameters. However, with no output schema and no annotation guidance, it does not describe the return format, error behavior, or how the findings are structured.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so both ipa_path and min_length are already documented in the schema. The description does not add parameter-specific meaning, but the schema does the heavy lifting, making the baseline score appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource: scans an IPA for hardcoded secrets and API keys. It also explains the two scanning layers, making the tool's function clear. It does not explicitly differentiate itself from related siblings such as ios_binary_strings, so it falls short of a 5.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explains what the tool does but gives no explicit guidance on when to use it versus alternatives. It does not mention ios_binary_strings, android_secrets_scanner, or conditions such as when a full secrets scan is preferable to a binary-only scan.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.