fossa_create_oidc_provider

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description goes well beyond annotations by stating 'WRITES TO FOSSA' and requiring specific admin flags. It details a major security implication: 'whoever can call this can choose which issuer FOSSA will believe' and warns about unauthenticated deployments. This provides behavioral context about side effects and authorization beyond what readOnlyHint/idempotentHint/destructiveHint convey.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is moderately sized but each sentence adds value. It leads with the core purpose, then requirements, then security context, then parameter guidance. It is structured with line breaks for readability. It could be slightly tighter by merging some context, but no sentence is wasted.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a mutating admin operation with 3 parameters and an output schema, the description covers purpose, prerequisites, security implications, and parameter semantics. It does not discuss idempotency (annotation says false) or potential errors, but the presence of an output schema likely covers return values. Overall, it is nearly complete for an agent to invoke the tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description carries full burden. It defines issuer precisely: 'must be the issuer URL exactly as the provider mints it in the `iss` claim'. It explains scope/scope_id relationship: 'Use scope="team" with scope_id set to a team id... org scope takes no scope_id'. These are crucial semantic details not present in the bare schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states 'Register an OIDC identity provider that this FOSSA organization will trust' with the verb 'Register' and resource 'OIDC identity provider'. It distinguishes from sibling tools like get_oidc_provider and list_oidc_providers by focusing on creation, and from create_oidc_trust_relationship by explicitly noting this is the first half of a password-less login path.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

It provides clear usage context: this is for registering a provider, and it explicitly notes 'Adding a provider does not by itself let anyone in — a trust relationship does that', implying the alternative tool create_oidc_trust_relationship. It also mentions required environment variables (FOSSA_ALLOW_WRITES=true, FOSSA_ALLOW_ADMIN=true) as preconditions. However, it does not explicitly name a sibling tool or enumerate all when-not scenarios.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.