Auth

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=false, destructiveHint=false, and openWorldHint=true, so the safety profile is largely covered. The description adds a genuinely useful security-relevant behavior (password piped via stdin with --password-stdin, never in argv or the echoed command), but it does not say where credentials are written or what happens on failure. With annotations carrying the mutation profile, a 3 is appropriate.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, front-loaded with the purpose and the CLI anchor, with no filler. The security detail in sentence two earns its place. Slightly terse given the schema complexity, but well-structured.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a mutation tool with 0% schema description coverage and no output schema, the description is thin: it does not explain the params/params_json payload, the target instance, or the resulting credential state. Only the password-handling detail is covered, leaving the agent without enough to invoke it confidently.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the schema documents nothing about the two opaque params (params / params_json). The description names a `password` field and its stdin mechanism, which is some compensation, but it never explains the params vs params_json structure an agent must populate to call the tool.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb+resource ("Configure instance authentication") and anchors it to the concrete CLI command `now-sdk auth`, so an agent knows exactly what it does. It does not explicitly differentiate itself from auth-adjacent siblings like servicenow_refresh_auth_token, keeping it at a 4 rather than a 5.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no when-to-use guidance, no prerequisites (e.g., that an instance/host must be specified first), and no mention of the sibling auth tools it should be chosen over. The agent is left to infer all routing on its own.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.