pci_compliance_summary

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and destructiveHint=false, so the safety profile is known. The description adds valuable behavioral details beyond annotations: pagination semantics (offset 1-based, limit 1-1000, fetch_all), the deliberate omission of an ip filter due to a Qualys bug, and the presence of total_count for scope visibility. These are not redundant with annotations, giving solid transparency.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured: a clear one-line purpose, an Arguments list, and a brief caveat about the ip filter. Every sentence earns its place—no fluff. The layout is scannable and front-loaded with the core intent. It is concise but complete for its content.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With 5 parameters, 0% schema description coverage, and no parameter-level documentation, the description covers all necessary context: pagination, filtering, the missing ip filter, and total_count. An output schema exists, so extra return-value explanation is not needed. The description is fully adequate for an agent to select and invoke the tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description is the sole source of parameter meaning. It explains every parameter (offset, limit, dns, compliance_status, fetch_all) including ranges and purpose. It also explains why a parameter (ip) is missing, which is crucial for understanding behavior. This fully compensates for the lack of schema descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with 'Per-host PCI Pass/Fail status' which clearly identifies the resource and the nature of the data. The phrase 'The primary way to iterate hostnames' further specifies its role and distinguishes it from sibling tools that list assets, vulns, or scans.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly calls this 'The primary way to iterate hostnames,' giving clear when-to-use context. It also explains why there is no ip filter, providing a useful usage caveat. It does not explicitly mention alternative sibling tools, but the 'primary' designation and lack of ambiguity justify a 4.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.