Map an IaC check to a SOC 2 control

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnly, idempotent, and non-destructive behavior, so the bar is lower. The description adds valuable behavioral detail beyond annotations: it always returns mappingSource and confidence, explains what low confidence means, and clarifies that unmapped is a real answer rather than a failure. This materially helps an agent interpret the tool's response.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact and front-loaded. The first sentence states what the tool does, the second gives usage context, and the final paragraph explains output semantics. Every sentence earns its place with no filler or redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's simplicity, the rich input schema, the output schema, and the safety-related annotations, the description covers everything an agent needs: what it does, when to use it, what it returns, and how to interpret confidence and unmapped results. No critical behavioral gap remains.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the baseline is 3. The description adds semantic meaning for resourceType by explaining that it 'corroborates' and raises mapping confidence, which is not fully captured in the schema. It does not add much for checkId or checkName, but those are already well documented in the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('maps') and identifies the exact resource and outcome: a scanner check to a SOC 2 Trust Services Criterion. It also explicitly distinguishes itself from scan-based tools by stating it runs 'without running a scan,' which helps an agent separate it from siblings like scan_iac.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives clear when-to-use context: checks surfaced by another tool, CI output, or a scanner this server does not wrap. It also implies an exclusion ('without running a scan'), but it does not explicitly name alternative tools or state when to prefer those siblings.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.