Reconocimiento de red (sin credenciales)

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With readOnlyHint and openWorldHint already declared, the description adds real context: the dast_scope authorization gate, the credential-free nature, native scanning without nmap, and that ssh-audit only runs if uv is present. It still omits return shape, runtime expectations for large ranges, and how aggressively it probes hosts, so it only partly extends the annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with the core capability, then scope and dependency caveats, all in three tight sentences. The long enumeration of risky service types is dense but earns its place by telling the agent what findings to expect.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Covers the essentials for a multi-parameter open-world scanner: authorization boundary, credential-free behavior, scanner dependencies, and the categories of issues it produces as a proxy for output. Without an output schema, a brief note on result format or latency for 'full' scans would have made it complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 86%, so mode, ports, targets, concurrency, connect_timeout_ms and ssh_audit are already documented in the schema. The description reinforces the ssh-audit behavior and port scope but adds no syntax or default details beyond what the schema provides; baseline 3 applies when the schema does the work.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

States a precise set of verbs and resources: discover open ports/services, audit TLS posture (obsolete protocol, weak cipher, bad certificate), and flag risky exposed services. The 'sin credenciales' qualifier and the native TCP/TLS note sharply define what kind of scan this is, though it never names scan_host or scan_dast explicitly to draw the boundary.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives a clear usage precondition — targets must fall inside dast_scope — and clarifies the tool needs no credentials and no nmap, which tells the agent when this is the right choice versus credentialed tooling. It stops short of explicit when-not-to-use guidance or naming the sibling it replaces.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.