generate_sarif_report

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It does not disclose behavioral traits such as writing to a file (though the schema mentions outputPath), whether prior scan results are required, or any potential side effects. The description focuses on the format rather than the tool's runtime behavior, leaving gaps.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences, front-loaded with the primary action. The second sentence provides useful context about SARIF's adoption without redundant detail. Every word earns its place, making it highly concise and structured.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple tool with one param and no output schema, the description covers the 'what' and 'why' but misses some context: it does not explicitly state that a prior scan is required or that the output is written to a file (though schema implies it). Without annotations, an agent might not know if this is a read-only operation or requires existing scan data. Overall, it is adequate but has clear gaps.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema provides 100% coverage for the single parameter outputPath, including its default behavior (stdout). The description adds no additional parameter semantics, so the baseline of 3 applies. There is no extra context about how the parameter interacts with the tool's logic.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states a specific action: 'Generate a SARIF report' from a specific source ('Agentforce Capability Scan'). This is a verb+resource structure that distinguishes it from sibling tools like scan_agentforce or run_tests. It also provides context on what SARIF is, reinforcing the purpose.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explains when to use this tool by mentioning SARIF as the standard for GitHub Security tab, Azure DevOps, and CI/CD integrations. This implies usage for exporting scan results to those platforms. It doesn't explicitly exclude alternatives or mention prerequisites, but the context is clear enough for an agent to select it appropriately.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.