acunetix_use_api_key

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden, and it explains key behavior: pure X-Auth header authentication, works for both REST and GraphQL, no login/session constraints, and automatic enablement from environment variables. It does not detail side effects like overwriting existing auth or persistence, but the disclosed traits are substantial.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is short, front-loaded with '【官方推荐认证】', and structured as three bullet points. Each sentence adds unique value: the auth method, the parameter details, and the automatic-enablement caveat. No waste.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple one-parameter authentication tool with no annotations or output schema, the description covers purpose, parameter, compatibility, and an important environment variable shortcut. It is self-contained and leaves no critical gaps.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%, so the description must compensate, and it does admirably. It explains exactly how to obtain the api_key (Profile page → API Key → Generate new API key) and its format (64-bit key). This adds all needed meaning beyond the bare schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly identifies the tool's purpose: using an API key from the Profile page for authentication. It distinguishes itself from sibling login/logout tools by explicitly stating '无需登录' (no login) and that it works via X-Auth header. The verb+resource structure leaves no ambiguity.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

It provides an explicit when-not-to-use condition: if ACUNETIX_API_KEY is set in the environment, the MCP server already has it enabled and there is no need to call this tool. It also implies it is the recommended alternative to login by saying '官方推荐' (officially recommended) and '无需登录' (no login required), though it doesn't name the alternative tool directly.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.