Install key on host

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare mutation, openness and idempotency, but the description adds meaningful context beyond them: the password is read from ~/.ssh/<alias>.secret, forwarded via sshpass without landing in argv or logs, and the external tools ssh-copy-id/sshpass must be present. It does not note that the annotation destructiveHint=true implies existing authorized_keys entries may be altered, which is the one behavioral gap.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Three tight sentences, front-loaded with the action and immediately followed by the security-relevant mechanics and prerequisites. Slight redundancy between 'the password comes from the secret' and the following sentence naming ~/.ssh/<alias>.secret keeps it from a 5.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Prerequisites, credential handling, and the post-condition (key-based login, sudo reuses the secret) are all covered, and an output schema exists so return values need no explanation. The main omission is the lack of any cross-reference to trust_host, the sibling an agent might otherwise pick.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, with both alias and identity fully documented in the schema, so the baseline is 3. The description adds only the derived detail that the secret path is built from the alias; it says nothing extra about the identity parameter beyond what the schema already states.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Install a public key on the host') and anchors it to the familiar ssh-copy-id equivalent, so the action is unambiguous. However, it never distinguishes itself from the closely named sibling trust_host (or add_host), leaving an agent to infer which of the two key-related tools applies.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is implied rather than stated: 'After this, login proceeds by key' tells the agent this is a one-time setup step that precedes key-based login. There is no explicit when-to-use/when-not guidance and no routing to alternatives such as trust_host, which is the obvious near-sibling in this set.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.