revoke_api_key

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure. It states that the key immediately stops working, that revocation cannot be undone, that 2FA must precede the call, and that a Proof account is required. This is strong behavioral transparency.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The first sentence delivers the core purpose immediately. The structured Agent usage and ACCESS sections are detailed but every sentence adds necessary operational information for a destructive, 2FA-gated action. Nothing feels redundant.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a single-parameter tool with no output schema, the description covers the essential context completely: what it does, the irreversible consequence, the mandatory 2FA sequence, and account access requirements. An agent has enough information to invoke it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, and the schema already describes the id parameter as the 'API key ID to revoke.' The description says 'by ID' but adds no meaningful semantic detail beyond what the schema provides, matching the baseline of 3.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb and resource: 'Revoke an API key by ID,' and immediately clarifies the irreversible consequence. This clearly distinguishes it from sibling tools like revoke_proof, revoke_asset, revoke_auth_session, and revoke_authorization.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives excellent operational context: a 2FA prerequisite with an explicit step-by-step flow, plus access requirements. It does not explicitly name alternatives such as regenerate_api_key, but the destructive nature and unique scope make the appropriate use case unambiguous.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.