run_safe_command

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations are absent, so the description carries the full behavioral burden — and it delivers. It discloses automatic rejection of dangerous commands and directory escapes, the exact error signature (isError:true with rejection messages like dangerous or directory_escape), a 60s timeout with extendability, and unsuitability for dev servers/watch mode. This far exceeds what annotations alone would provide.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is long (8 sentences), but every sentence earns its place: purpose, default-use rule, safety rejection, anti-bypass protocol, destructive alternative, timeout caveat, test-suite routing, and cwd guidance. It is front-loaded with the core purpose and organized from general to specific. Slightly dense, but remarkably efficient for the volume of safety-critical information conveyed.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema and no annotations, the description must fully equip an agent to invoke the tool correctly. It covers the safety model, rejection behavior, timeout constraints, exclusions (dev servers), cwd semantics, and points to sibling tools (list_allowed_roots, run_destructive_command, run_command_grep) for complementary operations. Nothing essential for correct invocation is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3. The description adds meaningful usage context beyond the schema: it instructs agents to always pass 'cwd' when targeting a non-primary project and gives a concrete timeout example ('e.g. 180,000 for jest'). This extra operational guidance justifies a 4.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The first sentence states a specific verb and resource: 'Executes a safe command inside the project folder.' It explicitly differentiates itself from siblings by naming run_destructive_command for dangerous operations and run_command_grep for grep-style execution, so an agent can immediately tell which tool is which.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly says 'use it whenever you are not sure whether a command is dangerous,' names run_destructive_command as the alternative for dangerous operations, and even tells the agent NOT to bypass rejections by switching tools without user consent. It also directs test suites, typechecks, and builds to this tool or run_command_grep rather than the built-in terminal. This is exemplary when-to-use vs when-not-to-use guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.