scan_directory_with_ash

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description discloses several behavioral traits: multiple scanners are run, semgrep is excluded, and installation requirements are provided. However, it omits a key behavior reflected in the schema: the return_output parameter defaults to false, meaning output is saved to file rather than returned, and the 'Returns' section implies a dictionary is always returned without mentioning this flag. Since no annotations exist, the description carries the full burden and this is a notable gap.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with clear sections, front-loaded purpose, and no fluff. The supported file types list and installation notes are useful, though the text is somewhat long. It earns a high score for organization and relevance.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity and the presence of an output schema, the description covers many important aspects: scanner list, file type support, installation, and the semgrep exclusion. However, it does not explain the return_output/save-to-file behavior, which is a significant omission for a tool that can save results. The overall picture is fairly complete but has clear gaps.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema provides complete parameter documentation. The description's Args section repeats directory_path and severity_threshold but adds no new meaning; it also omits the return_output parameter entirely. The supported file types and severity level list add some context, but not enough to raise the score above the baseline.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource: 'Scan an entire project directory with ASH for comprehensive security analysis.' It distinguishes itself from scan_with_ash ('Unlike scan_with_ash which scans code snippets') and from scan_directory_with_semgrep ('Use scan_directory_with_semgrep instead'). It also names the underlying scanners.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly explains when to use this tool vs alternatives: it scans actual project directories, while scan_with_ash scans snippets, and semgrep is excluded so scan_directory_with_semgrep is recommended. It also lists supported file types and gives installation instructions, providing clear context for usage.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.