fossa_exchange_oidc_token

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations indicate this is a write operation (readOnlyHint=false) and not idempotent, and the description reinforces this with 'WRITES TO FOSSA.' It goes beyond annotations by disclosing that the minted token is deliberately not returned, the response contains identity and metadata instead, the token remains valid for 15 minutes to 12 hours, and specific error conditions all return 400. This provides rich behavioral context beyond what annotations alone convey.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with bold headings, clear paragraphs, and front-loaded purpose. It is longer than strictly necessary, especially the security rationale about the token not being returned, but that content is valuable for transparency and safety. Every sentence contributes to understanding the tool's behavior, so it earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a complex, security-sensitive tool, the description is remarkably complete. It covers the operation, prerequisites, return value semantics, error handling, and even the alternative API call. The output schema exists, which likely documents the response structure, so the description does not need to repeat that. The only minor gap is full parameter semantics, but overall completeness is high.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate. It explains `token` (JWT from identity provider) and `username` (FOSSA service account), but does not describe `provider_id`, `expires_in`, or `is_push_only`. Since `provider_id` is a required parameter, the lack of explanation for it is a meaningful gap, though the tool's purpose and the mention of 'unknown provider' errors partially infer its role.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: to check whether an OIDC trust relationship works by performing the token exchange a CI job would perform. It explicitly distinguishes from sibling tools by saying 'use this to answer "is my trust relationship configured correctly?", not to obtain a token.' This is a specific verb+resource combination.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives explicit guidance on when to use this tool versus when not to. It states to use it for verification, not for obtaining a token, and directs CI jobs needing the real token to call `POST /oidc/token-exchange` directly. It also notes required environment variables (FOSSA_ALLOW_WRITES, FOSSA_ALLOW_ADMIN), providing clear context and exclusions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.