android_secrets_scanner

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description bears full burden. It discloses that the tool runs strings or scans text files, implying a read-only operation. However, it does not describe the output format, potential performance implications, or confirm that the tool does not modify the APK, leaving some behavioral gaps.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is extremely concise, consisting of two sentences that front-load the purpose and efficiently explain both usage modes. Every sentence adds necessary information without redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With 3 parameters, no output schema, and no nested objects, the description covers scanning behavior but omits what the tool returns (e.g., list of found secrets, file paths). A more complete description would include output format to help agents process results.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so baseline is 3. The description adds value beyond the schema by explaining the behavioral difference between providing and omitting smali_folder, and implicitly ties min_length to the strings command. This extra context merits a 4.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states 'Scans an APK for hardcoded secrets and API keys.' This specifies a unique verb-resource combination that distinguishes it from sibling tools like android_api_extractor or apk_permissions_checker, which focus on API extraction or permission analysis respectively.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explains when to use the smali_folder parameter: without it, the tool runs strings on binary files; with it, it scans specific XML and asset files. This provides clear context for optional usage, though it does not explicitly exclude alternatives like ios_secrets_scanner for iOS APKs.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.