scf_custom_risk_read

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The readOnlyHint annotation already establishes the safety profile, so the description only needs to add scoping context. It confirms this read covers org-defined risks and their linked controls, but adds nothing about permissions, whether custom risks are mutable through this path, or output shape beyond what the schema's enum text already supplies.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, zero waste, with the resource and both modes front-loaded before the method hint. Nothing is repeated or padded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a low-complexity read tool with a fully documented three-parameter schema and no output schema, the definition covers what is needed to call it. The one soft spot is that the conditional dependency of risk_code on the controls method is only implied by 'linked to one' and carried by the schema, not stated in the description.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% and the method enum text is unusually rich (R-ORG-N codes, catalog_control_ids, links, scoped_controls with implementation status), so the baseline is 3. The description contributes 'list them, or list the controls linked to one', which paraphrases the enum semantics in task-oriented language and slightly clarifies intent beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (read) and resource (organization-defined custom risks) and enumerates both modes: listing risks or listing controls linked to one. It does not differentiate itself from scf_risk_read (static catalog risks) or scf_custom_risk_write, so an agent must infer that boundary from the name prefix alone.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

'Pick with method' tells the agent that the method parameter selects the operation, and the two modes are named. However, there is no explicit when-to-use guidance against alternatives such as scf_risk_read or scf_custom_risk_write, nor a statement that the controls mode requires an existing risk_code.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.