Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries full burden but lacks behavioral details. It mentions 'comprehensive' but doesn't specify what that entails (e.g., aggregation method, output handling, permissions, or rate limits). This is inadequate for a tool that likely involves data processing and report generation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, efficient sentence with no wasted words. It's front-loaded with the core action and resource, making it easy to parse quickly.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (generating reports from multiple scans) and lack of annotations and output schema, the description is insufficient. It doesn't explain what the report contains, how scans are aggregated, or what the output looks like, leaving significant gaps for the agent.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema fully documents parameters. The description adds no additional meaning beyond implying 'all scans' relates to scan_ids, but this is already clear from the schema. Baseline 3 is appropriate as the schema does the heavy lifting.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action ('generate') and resource ('comprehensive security report from all scans'), making the purpose evident. However, it doesn't explicitly differentiate from sibling tools like run_*_scan tools, which perform scans rather than generate reports from existing scans.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is provided on when to use this tool versus alternatives. It doesn't mention prerequisites (e.g., needing completed scans), exclusions, or how it relates to sibling tools like validate_security_policy, leaving the agent to infer usage context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden of behavioral disclosure. It states 'Execute DAST scan' but lacks details on what this entails: whether it's a long-running process, if it requires specific permissions, potential side effects (e.g., network traffic, resource usage), or expected outcomes. For a tool that likely performs security testing with multiple parameters, this is insufficient.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is extremely concise with a single sentence, 'Execute DAST (Dynamic Application Security Testing) scan,' which is front-loaded and wastes no words. It efficiently conveys the core action, though this brevity comes at the cost of detail.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the complexity (4 parameters including nested objects, no output schema, and no annotations), the description is incomplete. It doesn't explain what DAST scanning involves, the output or results, how to interpret scan outcomes, or behavioral aspects like execution time or error handling. For a security testing tool with multiple configuration options, more context is needed.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the input schema already documents all parameters (target_url, project_path, scan_type, authentication) with descriptions. The description adds no additional meaning beyond what the schema provides, such as explaining the differences between scan_type options or how authentication is used. Baseline 3 is appropriate when the schema does the heavy lifting.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description states the action ('Execute') and resource ('DAST scan'), which provides a basic understanding of purpose. However, it's vague about what DAST scanning entails and doesn't differentiate from sibling tools like run_iast_scan or run_sast_scan, which are also security testing tools. The description merely restates the tool name without elaboration.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is provided on when to use this tool versus alternatives. The description doesn't mention sibling tools like run_iast_scan or run_sast_scan, nor does it explain the context for choosing DAST over other security testing methods. There's no indication of prerequisites, timing, or exclusions for usage.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries full burden. It states 'Execute... scan' which implies a potentially resource-intensive or time-consuming operation, but doesn't disclose behavioral traits like whether it's destructive, requires authentication, has rate limits, or what the output looks like. This is inadequate for a tool with 5 parameters and no output schema.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, efficient sentence that front-loads the core purpose. Every word earns its place by specifying the scan type and scope. No unnecessary details or redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given 5 parameters, no annotations, and no output schema, the description is insufficient. It doesn't explain what the tool returns, how long it runs, error conditions, or security implications. For a complex scanning tool with multiple configuration options, more context is needed to use it effectively.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so parameters are well-documented in the schema itself. The description adds no additional parameter semantics beyond implying the scan targets a runtime environment. This meets the baseline for high schema coverage but doesn't enhance understanding of parameter usage or interactions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action ('Execute') and the resource ('IAST scan'), specifying it involves 'Runtime Configuration & Header Analysis'. This distinguishes it from sibling tools like run_dast_scan or run_sast_scan by focusing on IAST methodology. However, it doesn't explicitly contrast with all siblings (e.g., run_sca_scan).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides no guidance on when to use this tool versus alternatives. It doesn't mention prerequisites, when IAST is appropriate compared to DAST/SAST/SCA, or any exclusions. The agent must infer usage from the tool name and context alone.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden of behavioral disclosure. It states the action ('Execute') but lacks details on execution behavior, such as whether it's a long-running process, if it requires specific permissions, potential side effects, or what the output looks like. This leaves significant gaps for a tool that performs security scanning.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, direct sentence with no unnecessary words, making it highly concise and front-loaded. It efficiently communicates the core action without any fluff or redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the complexity of security scanning and the lack of annotations and output schema, the description is insufficient. It doesn't explain what the tool returns, how results are structured, or any behavioral nuances, leaving the agent with incomplete context for effective use.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 100% description coverage, providing clear details for all three parameters. The description doesn't add any parameter-specific information beyond what's in the schema, so it meets the baseline score of 3, as the schema adequately handles parameter documentation.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action ('Execute') and the resource ('SAST scan'), making the purpose evident. However, it doesn't differentiate this tool from its siblings like 'run_dast_scan' or 'run_sca_scan', which are also security testing tools but for different types of scans.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides no guidance on when to use this tool versus alternatives. It doesn't mention when SAST scanning is appropriate compared to DAST, IAST, or SCA scans, nor does it specify prerequisites or exclusions for usage.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries full burden but only states the action without behavioral details. It doesn't disclose execution time, output format, error handling, side effects (e.g., file modifications if 'fix_vulnerabilities' is true), or security implications. For a tool that might modify files or run intensive scans, this is insufficient.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, efficient sentence with zero wasted words. It's front-loaded with the core action and resource, making it easy to parse quickly.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the complexity (security scanning tool with potential file modifications) and lack of annotations/output schema, the description is incomplete. It doesn't explain what the tool returns (e.g., scan results, vulnerabilities list) or critical behaviors, leaving significant gaps for an AI agent to use it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents all parameters thoroughly. The description adds no additional meaning beyond what's in the schema (e.g., explaining what 'SCA scan' entails or how parameters interact). Baseline 3 is appropriate when the schema does the heavy lifting.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action ('Execute') and resource ('SCA scan'), making the purpose immediately understandable. It doesn't differentiate from sibling tools like 'run_sast_scan' or 'run_dast_scan' which would require explaining what distinguishes SCA from SAST/DAST, so it doesn't reach the highest score.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides no guidance on when to use this tool versus alternatives like 'run_sast_scan' or 'generate_security_report'. It lacks context about prerequisites (e.g., needing dependencies installed) or typical scenarios for SCA versus other security scans.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden of behavioral disclosure. It only states what the tool does ('validate') without explaining how it behaves—e.g., whether it's read-only, if it modifies data, what permissions are needed, or what the output looks like. This is inadequate for a tool with no annotation support.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, efficient sentence with zero waste. It's appropriately sized and front-loaded, directly stating the tool's purpose without unnecessary elaboration.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the complexity of security validation, lack of annotations, and no output schema, the description is incomplete. It doesn't cover behavioral aspects, usage context, or result expectations, leaving significant gaps for the agent to infer. This is insufficient for effective tool selection and invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 100% description coverage, clearly documenting both parameters ('policy_file' and 'scan_results'). The description adds no additional meaning beyond what the schema provides, such as explaining the relationship between parameters or validation logic. Baseline 3 is appropriate since the schema does the heavy lifting.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description 'Validate security policy compliance' states a clear purpose with a specific verb ('validate') and resource ('security policy compliance'), but it doesn't distinguish this tool from its siblings like 'generate_security_report' or the various scan tools. The purpose is understandable but lacks differentiation.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides no guidance on when to use this tool versus alternatives. With siblings like 'generate_security_report' and multiple scan tools, there's no indication of context, prerequisites, or exclusions. This leaves the agent without usage direction.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.