scan_with_semgrep

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description must fully disclose behavioral traits. It mentions that the tool 'analyzes' and 'returns' results, but it does not state whether the scan is read-only, whether any network calls are made, rate limits, or limitations. Since it's a security scanner, it likely has no side effects, but this is not disclosed, leaving a transparency gap.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with sections for purpose, languages, args, and returns. The language list is necessary but length, and there is no redundant fluff. It front-loads the primary purpose and provides the essential details without excessive verbosity.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple two-parameter tool with an output schema, the description is mostly adequate. It explains the arguments and return type. However, it does not explicitly distinguish this tool from the sibling 'scan_directory_with_semgrep', so an agent might be unclear when to use this content-based variant versus a directory scan. This is a notable completeness gap.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema already describes both parameters, but the description adds value by listing the full set of supported languages (expanding on the schema's 'etc.') and clarifying that 'code' refers to source code content. This helps the agent select valid values for the language parameter, going beyond the schema alone.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's function: 'Scan source code using Semgrep for security vulnerabilities.' It identifies the specific tool (Semgrep), the resource (source code), and the scope (security vulnerabilities, bugs, anti-patterns). This distinguishes it from other sibling scanners by naming the engine and the input type (code content vs directory).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage by listing supported languages and describing the code parameter, but it does not explicitly state when to choose this tool over alternatives like scan_with_bandit or scan_directory_with_semgrep. There is no 'use when...' or 'not for directories' guidance, leaving the context implicit rather than explicit.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.