posture_check

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false, so the safety profile is fully covered. The description adds real value beyond that by disclosing the coverage domains and the specific flagging rule for installed-but-not-running security services. It stops short of anything else behavioral, such as how deep the IDS check goes or whether missing services cause errors.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short sentences with the domain coverage front-loaded and the salient flagging behavior immediately after. It is efficiently sized, though the second sentence is a sentence fragment and the first reads as a noun-phrase label rather than a verb statement.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return structure need not be explained, and with no parameters the call mechanics are trivial. What it covers plus the one notable anomaly it reports is enough for an agent to decide to call it; only the relationship to security_audit and the depth of each domain check remain unstated.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool takes zero parameters, so per the baseline there is nothing the description needs to disambiguate, and it correctly adds no parameter chatter. It could have stated that no scoping (host, time range, service filter) is possible, which would have set expectations, but the omission is minor for a zero-argument call.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a concrete resource (a health snapshot spanning system, services, and IDS state) and its distinguishing behavior: flagging security-relevant services installed but not running. That implicitly separates it from the narrower siblings system_status, service_list, and suricata_status, though it never names them explicitly, so the differentiation is left to inference.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is only implied: an agent can infer this is the 'give me an overall picture first' tool because it aggregates three domains, while the siblings cover each individually. There is no explicit when-to-use statement, no exclusion such as 'use security_audit for a full compliance sweep', and no note on cost or whether it is safe to call frequently.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.