check_subdomailing

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint, idempotentHint, and destructiveHint, covering safety. The description adds beyond annotations by specifying that it analyzes the SPF include chain for dangling domains, providing behavioral context. No contradictions.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is highly concise: two sentences plus a brief note. Every sentence adds value—defining purpose, specifying usage, and contextualizing within the audit. No wasted words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's specialized nature (SubdoMailing detection) and the presence of an output schema, the description sufficiently explains the input domain, the analysis performed (SPF include chain), and its role (part of scan_domain audit). It provides enough context for an AI agent to select and invoke correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so baseline is 3. The description does not add significant meaning beyond schema descriptions for parameters (domain, format, force_refresh). It only provides the tool's overall context, not parameter-specific details.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool detects SubdoMailing risk by analyzing SPF include chains for dangling or hijackable subdomains. It distinguishes itself from siblings like check_spf (which checks SPF validity) and check_subdomain_takeover (general takeover), making its specific purpose unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly states when to use the tool ('Use when you want to know if an SPF include chain can be hijacked...') and positions it as part of scan_domain audit. It lacks explicit when-not-to-use instructions or named alternatives, but the usage context is clear and well-defined.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.