driftguard_remediate_secret

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations at all, the description carries the full burden and does well by naming the three concrete mutations: writing the secret into .env, editing .gitignore, and rewriting the source value to process.env.<VAR>. It leaves real gaps, though - no statement about permissions, whether an existing .env is preserved or overwritten, whether the source edit is reversible, or that the secret remains in git history.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

A single front-loaded sentence that packs the action and all three effects with no filler or repetition. Every clause contributes a distinct piece of information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a mutation tool with no annotations, no output schema, and a nested object parameter, the description covers what changes but not the outcome: no return value description, no failure modes (e.g. missing .env, write errors), and no note on whether the operation can be undone. Adequate to trigger the tool, thin for predicting its effects.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

There is only one parameter and schema coverage is 100%, with the schema itself explaining that it is the finding object from driftguard_scan_secrets. The description adds no further meaning about that object (required shape, which fields are consumed), so the baseline of 3 for a fully documented single parameter applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

States a concrete verb and resource (moves a plaintext-found secret into a local .env file) plus the two side effects it guarantees: adding .env to .gitignore and replacing the literal with process.env.<VAR>. This is specific enough to separate it from driftguard_scan_secrets (detection) and from the rollback/snapshot siblings (unrelated remediation).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is only implied: the sole parameter is the finding object returned by driftguard_scan_secrets, which suggests this is the follow-up step to a scan. There is no explicit when-to-use/when-not guidance, no mention of prerequisites, and no reference to any alternative remediation path among the many sibling tools.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.