Keep Attacker Whole

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations present the description carries the full load and does so: it declares the tool mutating, says a model version is created, explains the decision's persistence semantics (the split is no longer offered while the decision stands, the attacker is left as-is), enumerates the 409 failure modes by code, and documents the delegation/escalation path including the anti-pattern of retrying.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with the action and its mutating nature, then error conditions, then escalation handling. Three short paragraphs, each doing work, though the enumerated return shape is redundant given the tool already has an output schema.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a mutating decision tool with no annotations, this covers effect on state, versioning, failure codes, authorization/escalation behavior with a concrete next step, and return values. The remaining gap (undocumented server_version) is minor and largely a schema concern.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 75%, so model_id, attacker_id and reason are already documented in the schema; the description only reinforces that a 'why' is required ('with why', 'A program's decision is a judgment'). The required server_version parameter is undocumented in both places, and the description adds no format or constraint detail beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The first line names a specific verb and resource and states the scope precisely: keep an attacker that was offered for a split, whole, with a reason, and notes it creates a model version. The word 'split' signals the counterpart tool (split_grouped_attacker) but the sibling is never named, so an agent must infer the opposition rather than being routed to it.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description establishes the triggering condition (a split is offered for this attacker) and the consequence of acting, plus explicit recovery guidance for the 403 case: do not retry, report the escalation_id and poll list_proposals. It stops short of stating the inverse alternative by name ('if you want the split, call split_grouped_attacker instead') or when dismiss_proposed_attacker is preferred.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.