Check Security Headers

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The readOnlyHint annotation already covers the safety profile, so the description's burden is low — and it exceeds it. It discloses the return contract (0-100 score, A-F grade, per-header analysis, actionable recommendations) and the execution profile (single HTTP request, no browser). This helps the agent set expectations for cost and output without an output schema. No contradiction with annotations; 'audit' is consistent with readOnlyHint=true.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Three sentences, each earning its place: the first states purpose, the second defines the output contract, the third communicates the resource profile. The most decision-relevant information is front-loaded. Zero filler, no repetition of schema or annotation content.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a single-parameter, read-only tool with no output schema, the description is contractually complete: the agent knows what is audited, what result shape to expect, and what the operation costs. Minor assumptions (e.g., URL must be publicly reachable, redirect handling) are acceptable for a tool of this simplicity. Nothing decision-critical is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already fully documents the url parameter ('The URL to audit for security headers'). The description reinforces the URL-as-target relationship by mentioning the audited headers, but adds no extra parameter-level semantics such as URL format constraints, protocol handling, or redirect behavior. Baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb-plus-resource: 'Audit HTTP security headers,' and enumerates concrete examples (HSTS, CSP, X-Frame-Options, Referrer-Policy, Permissions-Policy). This makes the tool unmistakably distinct from siblings like check_performance, check_redirect_chain, or check_mobile, which audit different dimensions. The scope is precise and self-identifying.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage context is implied rather than explicit. The 'lightweight — single HTTP request, no browser needed' note gives a meaningful hint about when this tool is appropriate (fast, cheap header spot-checks) versus heavier browser-dependent siblings like screenshot or crawl_site. However, the description never names alternatives or states when-not-to-use conditions, leaving routing to inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.