guard_generate_policy

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, openWorldHint=false, idempotentHint=true, and destructiveHint=false. The description adds meaningful context beyond that: it reads locally, sends nothing off the machine, and returns Markdown. It does not detail file handling or authentication needs, but the local-only behavior is a valuable disclosure.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is four sentences, front-loaded with the core action, and every sentence adds distinct value: non-generic nature, local execution, return format, and accepted parameters. There is no redundant or filler content.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers the tool's purpose, local execution, and output format, which is adequate given the annotations already declare its read-only and non-destructive nature. However, with no output schema and zero schema parameter descriptions, the definition should clarify how files and project_path interact and whether input is provided directly or via a path, leaving a clear gap for correct invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate. It names only three of five parameters (site_name, controller_name, dpo_email) and their broad purpose, leaving files (a nested array) and project_path completely unexplained. This is insufficient for a tool with five undocumented parameters.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Gera um rascunho de política de privacidade') and clarifies it is not a generic template, which distinguishes it from generic generators. However, it does not explicitly differentiate itself from sibling tools such as guard_generate_cookie_banner or guard_make_compliant.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is given on when to use this tool versus alternatives, nor are prerequisites stated (e.g., whether a scan must happen first). The description implies its purpose but leaves usage conditions entirely to inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.