analyze_security_headers

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Even with annotations already saying readOnly, idempotent, and non-destructive, the description adds concrete behavioral detail: 'fetches the page once over HTTPS, nothing is changed.' It also discloses the return structure (header presence/values, missing list, recommended config, server snippets), going well beyond the annotation hints.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The length is on the high side and includes a list of example headers, which is somewhat redundant for AI agents with common web security knowledge. However, the structure front-loads the core function, then gives behavioral detail, return summary, and usage guidance in a coherent flow. Each section earns its place, though tightening could help.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description compensates by enumerating the exact return items (HTTPS status, each header with present/missing and value, missing list, recommended config, copy-paste snippets). Along with a single simple parameter and abundant annotations, this is fully sufficient for an agent to invoke and interpret results.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% and the schema's parameter description already states 'Domain name only, e.g. example.com (no URL, path, or port).' The tool description adds context about HTTPS and live scanning but does not add new parameter syntax or constraints, so the baseline of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific action and resource: 'Scan a live website and report which HTTP security headers it currently sends.' It clearly distinguishes itself from the closely related sibling generate_security_headers by focusing on auditing a live site rather than generating a config.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Ends with explicit when-to-use guidance: 'Use this to audit a real site's header posture; use generate_security_headers when you just want a fresh best-practice config...' This directly names the alternative tool and the deciding condition, which is ideal for an agent.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.