nikto_scan

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description must disclose behavioral traits. It explains execution timing and background job handling, but fails to mention that the tool runs a network scan, its typical network behavior, required permissions, or what happens when a scan is error-prone. The absence of basic behavioral context (e.g., 'conducts HTTP requests to a target') harms transparency.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is relatively concise at about 60 words, but it front-loads a generic 'Kali Agent MCP tool' header without adding value. The structure prioritizes timing details over core purpose. While not verbose, it could be more efficient by leading with the scanning function.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool complexity (7 parameters, security scanning) and lack of schema descriptions, the description is incomplete. It does not mention the output schema (although one exists), the scanning scope, or how it integrates with the agent's workflow. The focus on timing alone leaves significant gaps in understanding the tool's full behavior and applicability.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description should explain all parameters. It explains timing parameters (expected_runtime_seconds, timeout_seconds, etc.) and on_timeout semantics, but does not describe the required 'target' parameter or 'additional_args'. The core parameters are left unexplained, limiting the agent's ability to set them correctly.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description does not explicitly state that the tool performs a Nikto web vulnerability scan. It only mentions 'nikto_scan' and 'Kali Agent MCP tool', but lacks a clear verb+resource. Sibling tools like nmap_scan have similar vagueness, but given the name, the purpose is somewhat implied, though not clearly articulated.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides guidance on choosing timing parameters and on_timeout values (e.g., use 'continue_background' for long work, 'kill' or 'return_partial' for synchronous). However, it does not differentiate when to use this scanning tool over siblings like nmap_scan, dirb_scan, or sqlmap_scan. The guidance is limited to execution timing, not tool selection.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.