List API keys

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already establish readOnly, idempotent, and non-destructive behavior. The description adds valuable context beyond annotations: secrets are never returned, only a prefix and last four characters, which is critical for agents handling sensitive data.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Two concise sentences deliver the core purpose, output characteristics, and auth requirement with no redundant wording. The most important security behavior is front-loaded in the second sentence, making it highly scannable.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple list operation with optional pagination parameters and no output schema, the description covers the essential return details (fields included, secrets omitted) and the required scope. It does not describe pagination response shape, but the schema already documents cursor semantics.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the parameters (limit, ending_before, starting_after) are fully documented in the schema. The description adds no parameter-specific detail, which is acceptable since the schema carries the burden.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses the specific verb 'List' with a clear resource ('the account's API keys') and specifies the returned fields (scopes, spend limits, last use). This clearly distinguishes it from sibling tools like create_api_key, revoke_api_key, and rotate_api_key.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description states a clear prerequisite ('Requires scope api_keys:read') and makes the read-only nature obvious. It does not explicitly name alternative tools for creating/revoking keys, but the context of siblings and the 'List' action leave little ambiguity.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.