webhook_verify

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full behavioral burden and addresses it well: it names the constant-time comparison, the byte-equal condition for matches=True, and the exact return-key set. It could add error behavior or clarify the 'valid' key, but the core verification semantics are disclosed.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Compact and front-loaded: the first sentence states the action, the second links to the sibling and identifies the difference, and the third enumerates the return contract. No filler; every line earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool is more complex than a simple filter: seven parameters, no annotations, and no output schema. The description gives good behavior and output shape, but leaves parameter semantics largely to the schema and does not define how timestamp or template interact with verification.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description needed to explain the seven parameters; it only names signature and points at webhook_sign for the rest. Body, secret, encoding, template, algorithm, and timestamp semantics are largely left to the schema's titles and defaults.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

Opens with a specific verb and resource, 'Constant-time verify an HMAC webhook signature,' and explicitly contrasts with the sibling webhook_sign by noting it shares parameters plus the signature. This lets an agent distinguish verify from sign without inspecting the schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The 'Same parameters as webhook_sign plus the candidate signature' line positions it relative to its natural sibling, and the verify/sign pairing makes the intended use clear. It does not spell out when not to use this tool, but the constant-time verification context is enough to route an agent correctly.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.