Detect Cookie Consent

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden: it does disclose that analysis is limited to static HTML, implying no JavaScript execution or live rendering, which is valuable behavioral context. However, it says nothing about how the target is fetched, network behavior, failure modes, or rate limits, and it spends most of its text on an authorization warning rather than operation behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The authorization constraint is stated three times in slightly different words ('own or are authorised to audit', 'Defensive use only', 'own or have explicit written authorization to audit'), wasting most of the description on repetition. Only the first sentence carries unique information, so the text is not front-loaded with operationally useful detail.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return values need not be explained, and one parameter keeps complexity low. Still missing are the expected input format for 'url' and any hint about what the scan does at runtime (fetch vs. local read), which leaves an agent guessing about invocation mechanics.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0% and the single required parameter 'url' is undocumented in the schema, so the description must compensate. It partially does by implying the value can be a website, endpoint, or local project path, but it never specifies URL format, scheme requirements, or how local paths should be expressed.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The first sentence names a specific verb (detect) and specific resources (cookie consent banners, CMP markup, tracking scripts) and scopes the input mode to static HTML, which distinguishes it from dynamic browser-based testing. It does not differentiate itself from siblings such as scan_project_files or detect_third_party_transfers by name, so it falls short of a 5.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage guidance is limited to authorization constraints (own or have written authorization) and 'defensive use only'; there is no guidance on when to pick this tool over scan_project_files or run_full_audit. The constraint context is clear but the alternative-selection guidance is absent.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.