ai_code_scanner__scan_text

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full behavioral burden. It discloses the categories of insecure patterns it looks for, which is valuable, but never states that the operation is read-only, whether it makes external calls, stores content, or what kind of response it returns. For a scanner with zero annotation coverage, these omissions are notable but not fatal because scanning is conventionally non-mutating.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single front-loaded sentence with a parenthetical list of detectable issues; every clause conveys concrete information and there is no filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema and no annotations, the description should ideally hint at what a scan returns (findings format, severity, counts). It identifies the detection categories but gives no sense of the response shape or how findings are presented, leaving a gap for an agent trying to interpret results.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so both parameters are already documented in the schema. The description's mention of 'text string or code snippet' reinforces the content parameter but adds no syntax, format, or usage details for the optional label parameter beyond what the schema states.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb (Scan) and resource (text string or code snippet) and enumerates the exact pattern categories it detects, which helps distinguish it from generic scanners. Sibling differentiation is implicit through the 'AI/LLM integration patterns' scope, but it doesn't name overlapping alternatives like prompt_injection_scanner__scan_text or secret_scanner__scan_text.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The phrase 'text string or code snippet' implies this is for inline content rather than files or directories, which is a useful contextual cue. However, there is no explicit guidance on when to prefer this over sibling scanners (such as scan_file for persisted code or prompt_injection_scanner__scan_text for injection-only checks).

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.