email_spf_enumerate

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description discloses the recursive traversal behavior and the output content (IPs, CIDR ranges), which is valuable. However, with no annotations, it does not explicitly state that the tool is read-only or describe potential side effects like DNS query load, leaving the safety profile incomplete.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, with the main action front-loaded and the second sentence adding value about the tool's purpose and insights. No redundant words or filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no output schema, the description adequately conveys what the tool returns ('IP addresses and CIDR ranges') and the kind of infrastructure revealed. It does not cover edge cases, but for a simple two-parameter tool, this is sufficient.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Both parameters (domain and max_depth) are fully described in the input schema with 100% coverage. The description adds no additional parameter-level semantics, so it meets the baseline but does not exceed it.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('recursively walk') and resource ('SPF include chain'), clearly stating the tool's action: extract all authorized IP addresses and CIDR ranges. It distinguishes from sibling tools like email_check_spf by emphasizing deep enumeration, not just checking SPF presence.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly states it is 'useful for attack surface mapping and infrastructure reconnaissance', giving clear context for when to use it. It does not name alternative tools, but this use case helps an agent decide among the many DNS/email siblings.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.