scan_secrets

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden, yet it says nothing about whether the scan is read-only, what it does when a leak is found (report vs. block), how it behaves on large diffs, or what the findings look like. The disclosure of detection methodology (entropy + signature matching) is the only added behavioral context and is thin on its own.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

One front-loaded sentence with the action, target and technique in that order; no filler or redundancy. It is appropriately sized for a one-parameter scan tool.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no annotations and no output schema, the description should at least indicate what a scan yields (findings list, pass/fail, exit gating) and which diff scope is examined. The technique mention gives partial coverage, but return shape and failure semantics are left entirely unexplained.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The single parameter staged_only is fully documented in the schema (100% coverage, default and meaning included), so the schema does the work. The description only says 'Git diffs' generically and never reinforces the staged-vs-working-tree distinction, so it adds no meaning beyond the schema — baseline 3.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (audits), resource (Git diffs), target (API key and high-entropy secret leaks) and method (Shannon Entropy and credential signatures). An agent can distinguish this from siblings like smart_diff or detect_conflicts by domain, though the description never explicitly names or contrasts them.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no statement of when to call this (pre-commit review, CI gate, ad-hoc audit) and no mention of alternatives or when not to use it. The agent must infer the trigger condition entirely from the tool name and the word 'audits'.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.