scan_code

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the burden of disclosure. It discloses a key behavioral trait: 'No filesystem access', and explains the output behavior ('Returns findings sorted by severity') and the role of the filename parameter. It does not mention potential side effects, but for a scan tool, the absence of filesystem access implies a safe, read-only operation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is three concise sentences, each earning its place: purpose, output, and key limitation/parameter clarification. It is front-loaded with the main verb and resource, and contains no unnecessary words or repetition.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple two-parameter tool with no output schema and no annotations, the description provides the core information: what it does, what it returns (findings sorted by severity), and a key limitation (no filesystem access). The missing detail is the structure of findings, but the description is otherwise sufficient for an agent to invoke the tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema has 0% description coverage, so the description must compensate. It adds meaning to 'filename' explicitly as 'an optional label used for reporting', but for 'code' it relies on the overall tool description ('Scan a snippet of code') to infer its purpose. This partial compensation is helpful but incomplete, especially for the required 'code' parameter.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's action and scope: 'Scan a snippet of code for leaked secrets and insecure patterns (OWASP Top 10).' It also mentions returning findings sorted by severity, giving a complete picture. This distinguishes it from sibling tools by focusing on 'snippet' and explicitly stating 'No filesystem access', which contrasts with scan_path.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage for code snippets and excludes filesystem scanning via 'No filesystem access', but it does not explicitly name alternatives or say 'use scan_path for filesystem scanning'. The guidance is implicit rather than explicit, so it does not fully meet the 'when-to-use vs alternatives' criterion.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.