Audit a project's identity domain (Section 2) to detect security and compliance issues, returning structured findings.
Audita o domínio "identity" (Seção 2). Retorna findings estruturados.
| Name | Required | Description | Default |
|---|---|---|---|
| project_path | Yes | Caminho absoluto para o diretório raiz do projeto |
Changes observed during successful MCP inspections.
v0.1.0Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full behavioral burden, yet it only says it returns structured findings. It does not state that the operation is read-only, whether it writes any report artifacts, what it requires from the project, or how findings are shaped.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences, with the scoping statement front-loaded ahead of the return-value note. Efficient, though 'Seção 2' is an opaque reference that consumes space without informing the agent.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No output schema and no annotations means the description must supply behavioral and return context, but 'Retorna findings estruturados' is a placeholder rather than a description of findings. For an audit tool among many siblings, this is incomplete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% for the single project_path parameter, so the schema already documents it fully. The description adds no parameter-level detail beyond what the schema provides, which is the baseline 3 case.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a clear verb ('Audita') and a named resource/domain ('identity', Seção 2), so an agent can tell it apart from the secrets, XSS, or CORS audit siblings. However, it does not clarify how the 'identity' domain differs from the closely related sentinela_audit_auth sibling, and 'Seção 2' is an unexplained internal reference.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No when-to-use guidance, no prerequisites, and no mention of alternatives despite a crowded family of ~24 audit siblings. The agent must infer that this audits the identity domain and cannot tell from the text whether audit_auth or audit_full should be preferred or combined with it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.