generate_pentest_report

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure. It details important constraints such as 'save_to' being restricted to specific directories and the meaning of 'confirmed_only' as filtering to confirmed findings. However, it does not disclose potential side effects (e.g., file overwriting), return value (content vs. saved file path), or preconditions like requiring existing findings, leaving some gaps in transparency.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with a concise purpose statement followed by a bulleted parameter list. Each sentence adds value, and the format is easy to scan. The length is appropriate for a tool with seven parameters, and it front-loads the core purpose before detailing parameters.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (7 optional parameters, no output schema, no annotations), the description covers all parameters and provides usage context for 'confirmed_only'. It does not explicitly state what the tool returns (e.g., report content or saved file path), which would be useful for agent decision-making, but overall it is fairly complete for its complexity.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, but the description compensates by explaining every parameter in plain language. It clarifies semantics like 'min_severity' values, 'host' filter behavior, 'format' options with 'html' suitability for client delivery, and 'confirmed_only' as a filter tied to 'update_finding_status'. This adds substantial meaning beyond the schema's simple name/type/default declarations.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's function: 'Generate a professional finding-based pentest report with attack chains and remediation.' This uses a specific verb ('generate') and resource ('pentest report') with distinct features (findings, attack chains, remediation). It distinguishes from sibling tools like 'generate_report' by focusing specifically on pentest reporting.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides implicit context on when to use the tool, but does not explicitly contrast with alternatives. It does offer usage guidance for the 'confirmed_only' parameter, stating to use it after running a validation agent for a zero-false-positive report. However, there is no explicit statement of when to use this tool versus, say, 'generate_report' or how to configure it for typical scenarios.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.