hijack_subdomain_takeover

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure. It reveals that the tool optionally queries crt.sh, performs multiple checks (dangling CNAMEs, fingerprint matching), and includes 'HTTP confirmation' for verifying risks. This provides meaningful insight into the tool's operation, though it does not discuss potential side effects or rate limiting, which would be useful for a network-scanning tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, compact sentence that front-loads the tool's primary purpose. Every clause adds value: subdomain discovery, checks performed, and outcome reporting. No wasted words or redundant details.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's multi-step complexity and lack of an output schema, the description provides a solid overview of inputs, process, and output ('reports takeover risk with HTTP confirmation'). It omits specific output structure or time expectations, but for an agent deciding whether to invoke the tool, the description is sufficiently complete to understand its scope.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema covers 100% of parameters with clear descriptions, so the baseline is 3. The description adds context to 'use_ct' by mentioning 'Certificate Transparency (crt.sh)', but the schema already explains the default behavior for both parameters. The description does not significantly augment the schema's parameter documentation.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool performs a 'full subdomain takeover scan' with a specific verb ('scan') and resource ('subdomain takeover'). It details the process: discover subdomains, check dangling CNAMEs, match against fingerprints, and report risk with HTTP confirmation. This distinguishes it from sibling tools like 'hijack_dangling_cname' which target individual checks.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies use for a comprehensive takeover scan by calling it 'full', and the optional CT discovery is mentioned. However, it does not explicitly state when to use this tool versus the more specific hijack_* or ct_* siblings, nor does it provide exclusions or prerequisites. Usage context is implied but not clearly delineated.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.