Alcance autorizado (DAST y servidores)

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden and does disclose the important behavioral traits: this is a security gate, adding is a mutation that demands authorization provenance, and the agent must not add unconfirmed targets. It does not describe what removing does to existing scans or whether scope persists across runs, so it is strong but not exhaustive.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Three sentences, no filler, with the resource and its consumers front-loaded and the guardrail last, which is the right priority order for a security-relevant tool. It could be trimmed slightly since the evidence examples duplicate the schema's own examples.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

There is no output schema, yet the description never says what 'list' returns (target formats, who authorized, when added) or what a failed add looks like, so an agent calling the read branch knows the trigger but not the shape of the result. For a four-parameter gated tool this is adequate but leaves a real gap.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 75% and the schema already annotates target formats and marks evidence/authorized_by as '(obligatorio para add)'. The description largely restates that ('Agregar exige quién autorizó y la evidencia', with the same example evidence types), adding the rationale but little new semantics beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

Opens with a specific verb triple plus the resource ('Lista, agrega o quita objetivos autorizados') and immediately ties the resource to the exact consumers ('scan_dast y scan_host por SSH'). An agent can distinguish this scope-management tool from the scanners themselves without opening any schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

States the precondition for one branch clearly: adding requires authorization evidence and an explicit user confirmation, and it tells the agent what evidence counts (contrato, ticket, ser dueño del sistema). It lacks an explicit statement of when to prefer 'list' first or when not to remove a target, so it falls short of full when/when-not/alternatives coverage.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.