dns_enumerationResolve selected DNS record types for one authorized domain to map its DNS infrastructure during security reconnaissance.
Resolve selected DNS record types for one authorized domain.
| Name | Required | Description | Default |
|---|---|---|---|
| domain | Yes | ||
| record_types | No |
| Name | Required | Description | Default |
|---|---|---|---|
| target | Yes | ||
| records | Yes | ||
| queried_at | Yes |
Changes observed during successful MCP inspections.
v2.2.0Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, openWorldHint=true, and destructiveHint=false, so the safety profile is fully covered structurally. The description adds only the authorization-scope context ('authorized domain'); it says nothing about per-type failure behavior, rate limits, or partial results, which is a modest contribution.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with no filler or redundancy. Efficient, though its brevity is partly the cause of the semantic gaps noted elsewhere.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return format need not be explained, and annotations cover the safety profile. Still, for a tool with 0% schema description coverage and numerous close siblings, the description does not supply enough scope or usage detail to fully orient the agent.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description carries the full burden. It names the domain and hints at selectable record types but adds no format, syntax, or constraint detail (e.g., the 8-type maximum, uniqueness, or what happens when record_types is omitted), only nominally overlapping the schema's own field names.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (Resolve) and resource (DNS record types) with a clear scope constraint ('one authorized domain'). However, it does not distinguish itself from the many DNS-adjacent siblings such as dnssec_posture_analysis, wildcard_dns_analysis, or dangling_dns_analysis, leaving the agent to infer the boundary.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The phrase 'for one authorized domain' implies an authorization prerequisite but gives no explicit when-to-use guidance, no exclusions, and no routing to alternative DNS tools. The agent must guess when general record enumeration is preferable to the specialized DNS siblings.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.