list_grc_controls

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description aligns with the readOnlyHint annotation, confirming it is a safe read operation. However, it does not add any behavioral context beyond the annotations, such as pagination behavior, default limit, or what 'list' returns (e.g., all controls or only active ones). With annotations already covering the safety profile, a score of 3 is appropriate.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence that is front-loaded with the action and resource. Every word is necessary, and there is no verbosity. It is extremely concise and well-structured.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool has no output schema and three parameters, the description could provide more context, such as what the return format looks like or pagination details. It is minimally adequate but leaves gaps for a complete understanding of the tool's behavior.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema covers all three parameters with descriptions (100% coverage). The description adds that filters are optional and mentions 'risk or policy', but 'policy' is not a parameter in the schema (only state and risk_sysid). This is a minor inaccuracy, and overall the description adds limited value beyond the schema, warranting a baseline score of 3.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb 'List' and the resource 'GRC controls', and mentions optional filters by risk or policy, making the tool's purpose immediately apparent. It distinguishes well from sibling tools like list_grc_risks or list_compliance_policies by focusing on controls.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description indicates when to use the tool (to list GRC controls with optional filters), but does not explicitly state when not to use it or provide alternatives among the numerous list tools. It is clear in context but lacks explicit exclusion guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.