identity_get_keys

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint, idempotentHint, destructiveHint=false and openWorldHint, so safety is covered. The description adds real context beyond that: the endpoint is deprecated and accessible anonymously. It still says nothing about response format or key rotation/caching behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The deprecation warning is correctly front-loaded, but the core sentence 'Defines the public keys used to verify the authenticity of the JWT token' appears twice verbatim, and the raw HTML access-policy table plus trailing URL are low-value clutter that dilute the call to action.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 0-parameter deprecated GET, the essential facts (deprecated, replacement path, anonymous access) are present. With no output schema, the description should sketch what is returned — a JWKS key set — but it only alludes to 'public keys', leaving the response shape implicit.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Zero parameters, so there is nothing for the description to disambiguate and the baseline of 4 applies. No parameter text is needed here.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific resource — the public keys used to verify JWT authenticity — and flags the tool as deprecated up front. It doesn't distinguish itself from identity_get_openid_configuration or identity_check_id_token, and the 'alternative' it names is an HTTP path rather than a sibling tool name, so routing is only partly resolved.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

'[DEPRECATED]' plus 'Use this API instead: /oidc/oauth2/jwks' is explicit when-not guidance, which is rare and valuable. It stops short of a 5 because the replacement is given as a raw endpoint path, leaving the agent to infer whether any listed sibling tool corresponds to it.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.