Check a domain's HTTP security headers

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already mark the tool as read-only, open-world, idempotent, and non-destructive, and the description adds meaningful behavioral context: it uses only public DNS and ordinary HTTP requests, performs no port scanning or exploit testing, and returns a 0-100 score plus per-header findings. This goes beyond the annotations and is especially valuable since there is no output schema.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is information-dense but every sentence earns its place: it opens with the core question, lists checked headers, explains the output, describes the non-invasive method, states the intended use cases, and points to the sibling tool for what it does not cover. There is no filler or repetition.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With one parameter fully documented in the schema, safety annotations already provided, and no output schema, the description still explains the return value (score plus per-header findings), the method of checking, and what it does not cover. The tool definition is complete enough for an agent to invoke and interpret it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema description covers the single domain parameter 100%, including accepted formats and refused input types, so the description does not need to add much. The description adds no additional parameter detail beyond reinforcing that the domain is a website domain, which is appropriate given full schema coverage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb ('Checks for') and resource (domain HTTP security headers), names the exact headers examined, and explicitly contrasts itself with check_tls by noting it does not check TLS certificates. This makes the tool's purpose unmistakable and distinguishes it from its siblings.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives explicit when-to-use guidance ('Use this for clickjacking, XSS mitigation, CSP or HSTS questions') and an explicit when-not-to-use case ('It does not check the TLS certificate itself — use check_tls for that'). It also clarifies what the check does not involve (no port scanning, no exploit testing), so an agent can select it appropriately.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.