nikto_scan

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of disclosure. It states that the tool performs a scan (active network behavior) and requires scope/authorization. It also mentions returning 'raw nikto findings' and a 'command and mode' in the output, which hints at execution details. However, it does not disclose potential side effects such as network traffic volume, duration, or alerting, which is important for a scanning tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with distinct metadata sections (USECASE, INSTRUCTIONS, INPUT_DESCRIPTION, OUTPUT_DESCRIPTION, EXAMPLES, PREREQUISITES, RELATED_TOOLS). It is somewhat lengthy but every section provides useful context. The opening line is concise and action-oriented, and the Args/Returns summary at the end is clear.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers prerequisites, instructions, examples, related tools, input semantics, and output structure. It gives sufficient context for an agent to understand what the tool does and how to use it. It does not exhaustively describe all possible return values, but the presence of an output schema (even if not detailed in the prompt) and explicit OUTPUT_DESCRIPTION mitigate that gap.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 0% description coverage, so the description must compensate. It does so by explaining target is a 'Web host or URL (must be in scope)' and port as 'Optional explicit port' with the INPUT_DESCRIPTION adding the default behavior ('default 80/from URL'). This adds valuable meaning beyond the bare schema types.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description starts with a specific verb+resource: 'Scan a web server for known vulnerabilities and misconfigurations (nikto).' This clearly distinguishes it from sibling tools like whatweb_fingerprint (fingerprinting) or dir_bruteforce (directory brute force), and the USECASE reinforces the purpose.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides clear context for when to use the tool via USECASE ('Identify dangerous files, outdated servers, and misconfigurations on an in-scope web host'), INSTRUCTIONS (ensure scope, provide target), and PREREQUISITES (host authorized and in scope). It lists related tools but does not explicitly differentiate when to choose this over alternatives, so it stops short of a perfect score.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.