List Passwords

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Even though readOnlyHint and destructiveHint are already set, the description adds substantial behavioral detail: it discloses that secret and OTP seed are withheld, that the API returns no total count, and that 'page_was_full' is the only honest pagination signal. It also states 'Operation class: Read' to reinforce safety. No contradiction with annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is organized into three compact paragraphs, each with a clear job: core purpose, secret-handling behavior, and pagination caveat. Every sentence adds value, with no filler or repetition of schema content. It is appropriately sized for a tool with this complexity.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description thoroughly explains return shape (items plus pagination facts), the missing total count, and withheld secrets — valuable since there is no output schema. Combined with the rich schema descriptions, it equips the agent well. However, the invalid reference to hudu_reveal_password (absent from siblings) leaves a small gap in actionable completeness, preventing a perfect score.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 90%, and individual parameter descriptions already explain most fields (page, fields, search, archived, page_size, company_id, updated_at, response_format). The description does not add new parameter-level meaning beyond what the schema already provides; it references pagination facts but not parameter syntax. Baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with 'List passwords in Hudu' — a specific verb and resource — and immediately clarifies that this is the credential vault list. It distinguishes itself from secret retrieval by explicitly stating that 'The secret value and any stored OTP seed are withheld from these results,' and it separates this list operation from hudu_reveal_password. The purpose is unmistakable and sibling differentiation is clear.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides useful context about when to use this tool: for metadata questions like 'does this client have a firewall admin credential documented, and when was it last rotated?' It also names hudu_reveal_password as the alternative for reading actual secrets. However, hudu_reveal_password is not present in the sibling tool list, so the agent cannot actually invoke it. There is no explicit contrast with hudu_get_password for single-record retrieval, leaving a gap in actionable guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.