dnssec_check_nsec

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the burden of disclosure. It effectively explains the tool's behavior: it reports NSEC vs NSEC3, and for NSEC3 includes hash algorithm, iterations, and salt, while flagging NSEC as an informational risk. It does not cover edge cases like non-DNSSEC zones, but the core behavior is clearly communicated.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise and well-structured, using three sentences that each add value: stating the action, explaining the distinction, and detailing the risk flag. No unnecessary words or repetition.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a single-parameter tool with no output schema, the description adequately explains what the tool reports (NSEC vs NSEC3, hash parameters, risk flag). It does not mention behavior for domains without DNSSEC or error cases, but given the simplicity of the tool, this is sufficient for an agent to understand the tool's scope.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, with the only parameter 'domain' having a clear description. The tool description does not add additional parameter-specific details beyond what the schema already provides, but none are needed given the schema's clarity. Baseline of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: 'Check NSEC/NSEC3 records for a domain' and distinguishes it from siblings by explicitly contrasting NSEC (enumerable) and NSEC3 (hashed names). It also specifies the outcome of flagging NSEC as a risk, making the tool's function highly distinct.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implicitly conveys when to use the tool (when needing to determine NSEC vs NSEC3 usage and associated risk). However, it does not explicitly mention alternatives or exclusion conditions, such as when a zone lacks DNSSEC or when other related tools like dns_nsec_walk would be more appropriate.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.