Api risk assessments risk assessment csv retrieve

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations declare readOnlyHint=true, idempotentHint=true, destructiveHint=false, yet the description says the endpoint allows assessments to be 'viewed or edited' — a direct claim of write capability that contradicts the read-only annotation. The description adds nothing verifiable about CSV output, auth needs, or size/rate implications of an export endpoint.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

It is a single short sentence with no filler, so it is concise, but the brevity is achieved by omitting the only useful facts (CSV export, id semantics) rather than by front-loading them. Short and empty rather than short and informative.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a parameterized export tool with no output schema and three near-identical CSV/xLSX/PDF siblings, the description supplies none of the missing context: not the output format, not what 'id' selects, not how it differs from risk_assessments_retrieve or risk_assessment_xlsx_retrieve. An agent cannot call this correctly without inferring everything from the tool name.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The single required parameter 'id' has 0% schema description coverage, so the description carries the full burden — but it never mentions the parameter at all. An agent cannot tell from the text whether 'id' is the risk assessment UUID, a scenario id, or a filter argument, and must guess for a CSV export keyed on a single identifier.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description is generic DRF boilerplate that restates the endpoint name rather than stating the operation: it never mentions that this retrieves a risk assessment in CSV format, which is the distinguishing trait in the tool name and separates it from risk_assessment_xlsx_retrieve and risk_assessment_pdf_retrieve. It technically names a resource (risk assessments) but the verb is vague ('viewed or edited') and would apply equally to dozens of siblings.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

No when-to-use guidance, no mention of prerequisites (an 'id' must be known), and no routing to the CSV/xlsx/pdf/plain-retrieve alternatives that exist as siblings. Worse, 'or edited' implies a write path that no annotation supports, so an agent could be steered toward the wrong mental model rather than merely left without guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.