okta_list_sessions

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and destructiveHint=false. The description adds valuable behavioral context beyond annotations, notably that the tool does NOT verify session validity. This helps the agent understand a key limitation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is highly concise: two short paragraphs and a return format example. It front-loads the purpose, explains the limitation in one sentence, and provides the output format. Every sentence provides necessary information without repetition.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no parameters and an output schema described inline, the description covers the tool's behavior, return format, and limitation about session validity. It does not mention error handling or rate limits, but for a simple read-only list tool with good annotations, it is sufficiently complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has no parameters, so the input schema fully covers them (100% coverage). The description is not required to add parameter details, achieving the baseline of 4 for zero-parameter tools.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states 'List all stored authentication sessions' with a specific verb and resource. It distinguishes from sibling tools by explicitly stating it does NOT verify session validity and directs users to okta_check_session for that purpose.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides a clear context for when to use the tool (listing all sessions) and an explicit alternative for verification (okta_check_session). It does not cover when to use versus other siblings like okta_login or okta_delete_session, but the purpose is distinct enough.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.