xor_brute_force

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description must fully disclose behavior. It mentions ranking by printable ratio and returns candidates sorted by ratio, but does not disclose what happens if no key works, performance implications, or boundary conditions. The brute-force process (trying all 256 keys) is implied but not stated.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is extremely concise with three short paragraphs: a clear purpose line, context, and structured args/returns. Every sentence adds value without redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the presence of an output schema (which likely details the return structure), the description adequately covers return behavior by saying 'Candidate decryption results sorted by printable ratio.' Parameter explanations are sufficient for a low-complexity tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Despite 0% schema description coverage, the description effectively explains both parameters: hex_data is 'Hex-encoded ciphertext data' and min_printable_ratio is 'Minimum printable character ratio threshold' with a default value. This adds significant meaning beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states its purpose with a specific verb-resource pair: 'Brute-force single-byte XOR decryption, ranked by printable character ratio.' This distinguishes it from sibling tools like xor_encode_decode which likely requires a known key.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage context ('Commonly used in CTF to decrypt simple XOR-encrypted flags or strings') but does not explicitly state when not to use this tool or compare it to alternatives. No exclusion criteria or alternative tool references are provided.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.