audit_gap_auditor__scan_directory

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are supplied, so the description carries the full behavioral burden. 'Recursively' usefully discloses that subdirectories are traversed, but it says nothing about whether this is a read-only operation, how loaded directories are handled, default exclusions (the schema's default maxFiles of 5000 is unmentioned), or what a 'gap' finding actually represents.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

A single front-loaded sentence with zero padding – the action, the input type, and the analysis target all appear before any filler. Nothing could be removed without losing information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Because no output schema exists, the description should convey something about the shape of results (findings, severities, counts), and it does not. Similarly it omits when to prefer it over scan_file. It is adequate for identifying the tool but leaves the return contract and usage context unstated.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so path, exclude, include, and maxFiles are already documented with their semantics and defaults. The description adds no extra meaning beyond the schema (e.g., no guidance on how exclude/include interact or typical patterns worth filtering), so the baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb ('Recursively scan'), resource ('directory of MCP server source'), and a precise target of analysis ('OWASP MCP08 audit/telemetry gaps'). The 'directory' scope inherently separates it from the same-namespace siblings scan_file and scan_text, though no sibling is named explicitly.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is only implied by the word 'directory' – an agent can infer this is the tool for scanning a whole tree rather than a single file, but there is no explicit when-to-use statement, no prerequisite (e.g., source must be an MCP server project), and no routing against the adjacent scan_file/scan_text/list_patterns tools.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.