Breach catalogue (HIBP)

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint and openWorldHint, and the description adds a genuinely useful behavioral fact not in structured data: no API key is required for this lookup. It still omits rate limits, pagination, and how sensitive results are handled (relevant given includeSensitive), but the auth disclosure is real added value over the annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

A single front-loaded sentence, verb and resource first, with the no-key fact and the example terms appended efficiently. It is compact and wastes nothing, though packing four concepts into one clause-chain makes it slightly dense.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a four-parameter tool with 0% schema description coverage and no output schema, the description leaves notable gaps: limit semantics, the sensitive-breach toggle, and the third sort enum value are undocumented. An agent could still make a basic call, but not a fully informed one.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%, so the description must carry all four parameters. It only partially does: 'search' is well illustrated via examples ('passwords', 'crypto', 'health') and 'sort' is partly covered ('most recent, largest' but not 'breachDate'), while 'limit' and the important 'includeSensitive' flag are never explained anywhere.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb+resource: 'Search the Have I Been Pwned breach catalogue', with the added scope note that it needs no API key. It implicitly differs from siblings like breach_details (single breach) and email_breaches/domain_breaches (account-scoped), but never names or contrasts with them, so it falls short of full sibling differentiation.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is implied through the offered query modes ('most recent, largest, or by keyword/data type'), which tells the agent what this tool is good for. There is no explicit when-to-use versus the sibling breach tools (breach_details, email_breaches, domain_breaches) and no stated exclusions or prerequisites.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.