identity_get_paginated_group_users

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint, idempotentHint, and destructiveHint=false, so the safety profile is covered. The description adds genuinely non-structured context: the access policy table showing which roles can call it and the filter semantics (contains match on name/email, onlyDirectUsers excluding nested-group members). It does not explain pagination behavior or result ordering, which keeps it from a 5.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The core purpose sentence is front-loaded after the deprecation banner, which is correct. But 'Get users in group within organization' appears twice verbatim, and the raw markdown access-policy table plus the raw endpoint line add structural noise. The content is useful but not tightly edited.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For an 8-parameter read tool with no output schema, the description covers purpose, auth/role gates, and filter semantics reasonably well. It omits any indication of the response shape (user record fields) and pagination/total-count behavior, which an agent would need to page correctly since no output schema exists.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 50%, and the description meaningfully covers the undocumented half: it explains that firstName, lastName, and email use 'contains' matching and what onlyDirectUsers=true does. It says nothing about pageStart/pageLimit beyond what their schema descriptions already state, so this is the expected baseline.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource: get users in a group within an organization, scoped by orgId and groupId. It also flags deprecation and names the successor API path. It does not differentiate itself from the many sibling identity user-listing tools, which is why it falls short of a 5.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The '[DEPRECATED]' marker plus 'Use this API instead: /scim/v2/Users' is a real when-not signal, which is more than most tools offer. However, it points to a raw HTTP endpoint rather than naming a sibling MCP tool, so an agent has no concrete substitute to route to, and there is no guidance on when this tool would still be legitimate.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.