skuuy_generate_totp

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations only declare readOnlyHint and idempotentHint, so the description usefully adds that the secret is 'processed ephemerally in memory, never logged or stored' and that sending it constitutes opt-in — real behavioral context beyond structured data. It stops short of details like rate limits or whether secrets are cached per-connection.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Purpose is front-loaded in the first sentence, followed by the privacy contract and compatibility note. Each sentence carries distinct information, though the parenthetical marketing for the browser vault is slightly promotional.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

There is no output schema, so the description carries the burden of explaining what a caller receives — yet it never says the response contains the OTP or the remaining validity window. Inputs and privacy are well covered; the return contract is the notable hole.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 50% schema coverage, the description compensates: it specifies the secret is base32 and that 'spaces/dashes tolerated', and the RFC 6238 reference contextualizes digits/period/algorithm defaults. The digits and algorithm parameters themselves remain undocumented in prose, though their enums and defaults are self-explanatory.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Generates a time-based one-time password (RFC 6238 TOTP) from a base32 secret') and pins the standard, which none of the sibling utilities (hash_encode, rpc, resolve_dns) do. An agent can tell instantly this is the TOTP generator rather than a generic crypto helper.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

It explains the opt-in model: 'By sending the secret you opt in to server-side generation' and names the zero-knowledge alternative (the browser vault). It does not describe when to prefer a sibling tool or any exclusion conditions, but the context for choosing this tool is clear.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.