verify_2fa_magic_link

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations only declare readOnlyHint=false and destructiveHint=false; the description adds genuinely new behavioral context (needs a Proof account, API key required, restart the server, or a login session that opens the tool). It does not state whether the token is single-use or what state changes on success, so it is helpful but not complete.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Two tight sentences: purpose first, then the access prerequisite. Every clause (magic link, email origin, token-as-proof, account setup) carries information, with no filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a one-parameter auth tool with no output schema, the definition covers purpose, the distinguishing mechanism, and the full access path. What happens after a successful verification (session effect, token consumption) is left unstated, a minor gap.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the single 'token' parameter is fully documented in the schema. The description adds a little meaning by tying the token to the verification email and asserting the token itself is the credential, but this is marginal beyond the schema baseline.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

'Complete a 2FA challenge using a magic link token' gives a specific verb and resource, and the phrase 'No code submission needed — the token itself is the proof' implicitly separates it from the code-based verify_2fa sibling. It stops short of naming that sibling, so the distinction still rests on inference.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The ACCESS block gives a concrete precondition and two routes (set PROOF_API_KEY, or run start_login so a session opens the tool). The 'no code needed' contrast implies when this tool applies over code-based verification, but no sibling is named explicitly, so a fully explicit when/when-not is absent.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.