bb_jwt_crack

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It discloses the core behavior (cracking with optional wordlist and default dictionary) but does not mention potential side effects (e.g., time consumption, network activity) or authentication requirements. The transparency is adequate but not exhaustive.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, efficient sentence that front-loads the purpose and includes a critical condition (auto-use dictionary). No extraneous words; every part earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given that the tool has no annotations and an output schema (though not detailed in description), the description lacks information about return values, failure modes, or potential side effects. For a cracking tool, details like timeout or network usage would be helpful. It is adequate but not fully complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate. It explains the wordlist parameter's default behavior (auto-use built-in dictionary) and implicitly clarifies the token parameter via tool name. However, it does not add explicit details for the token parameter. This provides moderate added value beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description explicitly states the tool's purpose: cracking JWT HMAC keys via brute-force. It uses a specific verb (破解/crack) and resource (HMAC key of JWT), and is clearly distinguishable from sibling JWT tools like bb_jwt_analyze or bb_jwt_decode.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description includes key usage information: attempting to crack HMAC keys and automatically using a built-in weak key dictionary if no wordlist is provided. It does not explicitly state when not to use it or mention alternatives, but the context is clear enough for an agent to decide.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.