List Waf Rules Tool

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

readOnlyHint=true already tells the agent this is a safe read, so the description doesn't need to re-establish that. It adds the mutually-exclusive zone identifier constraint, but says nothing about pagination, result caps, or scope limits that would matter for a listing endpoint.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short sentences, the purpose front-loaded and the constraint second. No filler, nothing redundant with the title.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return values need not be described, and the tool is a simple two-optional-param read. The description covers the key invocation ambiguity (which identifier to supply); only minor gaps remain around pagination and whether zero arguments is valid.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3, but the description adds a genuine constraint the schema does not encode: both parameters are nullable/optional in the schema with no mutual-exclusion or at-least-one rule, so "either zone_id or zone_name, not both" is real added meaning.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb ("List") and resource ("WAF custom rules for a zone"), which separates it cleanly from the create/update/delete_waf_rule siblings and from other list_* rule families. It does not explicitly name an alternative, but the resource is unambiguous enough to select without opening a schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The only guidance is "Provide either zone_id or zone_name, not both," which is a calling constraint rather than a when-to-use statement. There is no mention of when to prefer this over, say, get_security_events_tool or the specific rule-type listers, though the resource name makes the intent inferable.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.