authenticate

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Goes well beyond the annotations: 180-second loopback callback timeout, Desktop OAuth client flow, the fact that tokens are never returned to the caller, that force only mutates credentials after successful authorization, the requested scope (GOOGLE_GMP_SERVICES), and the read-only surface of this server despite broader scopes. These are exactly the side effects and constraints an agent needs for a non-idempotent, open-world auth call.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with the core action and the key safety fact (no tokens returned) in the first clause, then progressively deeper operational detail. Dense but every sentence carries information; the scope-vs-exposed-endpoints sentence is slightly wordy but genuinely useful context.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return values need not be described, and the description instead covers everything else an agent needs for a browser-based OAuth flow: host requirement, timeout, callback mechanism, credential-replacement semantics, and scope. The auth flow is fully actionable as written.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%, so the description must carry the load, and it does: 'account' is explained as a lower-case alias like 'work' that creates a separate login, and 'force=true' is explained as replacing the selected account's saved sign-in only after success. It does not mention the default values (force=false, account=null) or how the default account is chosen, leaving a small gap.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Sign in via the local browser and store credentials') and immediately distinguishes itself from every sibling by declaring it 'never returns tokens', which no other tool can claim. An agent can tell this is the authentication/session-establishment tool without reading the schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explains the account-alias pattern for separate logins and that force=true replaces a saved sign-in only after successful authorization, which effectively frames when to use force versus not. It also names a prerequisite ('Requires a browser on the server host'), though it never explicitly says when to call this versus proceeding straight to the list/query siblings.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.