Port Scan

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full behavioral burden, yet it says nothing about the intrusive nature of an active scan, authorization requirements, expected runtime, or rate limiting. The presence of a from_token parameter strongly implies a resumable/long-running scan, but the description never explains that behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

A single front-loaded fragment with zero filler, which is efficient. It is arguably under-specified rather than bloated, so it scores well on size but is not a model of helpful structure.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return values need not be described, and the schema fully documents parameters. What is missing is the behavioral and routing context an agent needs: when this scan is appropriate, its intrusive character, and the resumption semantics implied by from_token.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so host, top_ports, and from_token are already documented in the schema. The description's 'top-N' phrasing loosely echoes top_ports but adds no format, range, or usage nuance beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('port scan of a host') and adds the scanner family ('nmap top-N'), which is more than a restatement of the name. However, it does nothing to distinguish itself from the other scanning siblings such as nuclei_scan or http_probe, which an agent must disambiguate.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no indication of when to run a port scan versus nuclei_scan, http_probe, or waf_detect, and no prerequisites or ordering guidance (e.g. after dns_resolve or subdomain_enum). Usage is left entirely to inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.