get_threat_modeling_plan

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the disclosure burden. It does reveal the auto-validation behavior ('automatically run the threat model validation against the code') and return format, but it does not clarify whether the tool is read-only, potential side effects of validation, or error handling. The description offers some context but lacks completeness.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is structured with sections (intro, Args, Returns), but the opening sentence 'Get a comprehensive threat modeling plan' is redundant with the tool name. A more concise phrasing would improve it. Still, the format is organized and readable.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description is largely complete for a planning tool: it specifies the output format, mentions auto-validation, and documents parameters. However, it does not explicitly state when to use this vs. phase-specific guidance, and the ctx parameter is mentioned in Args but absent from the input schema, which could cause confusion. Overall, it provides sufficient context for invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%, so the description compensates effectively. It explains each parameter: 'directory: Directory to check for code files' and 'auto_validate_code: Whether to automatically validate against code.' This adds meaningful semantic detail beyond the bare schema types and defaults.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool 'returns a detailed threat modeling plan in markdown format, covering all phases of the threat modeling process.' This specifies the verb (get/returns), resource (threat modeling plan), and scope (comprehensive, all phases), which distinguishes it from sibling tools like get_phase_1_guidance or get_architecture_analysis_plan.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage by presenting it as the comprehensive planning tool, but it does not explicitly state when to use it versus alternatives, nor does it provide exclusions or prerequisites. The mention of 'covering all phases' hints at its role, but explicit guidance is absent.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.