Skip to main content
Glama
itunified-io

mcp-opnsense

by itunified-io

mcp-opnsense

GitHub release License: AGPL-3.0 CalVer Node.js MCP Tools TypeScript mcp-opnsense MCP server

Slim OPNsense MCP Server for managing firewall infrastructure via the OPNsense REST API.

No SSH. No shell execution. API-only. 3 runtime dependencies.

Table of Contents

Related MCP server: coreyhines/opnsense-mcp

Enterprise Edition

For audit + compliance reporting, multi-firewall fleet operations, encrypted backup orchestration, capacity forecasting, advanced IDS tuning, and Q-Feeds Premium feeds, see the commercial tier:

mcp-opnsense-enterprise — €29/month/seat

Tier comparison:

Tier

This repo

Enterprise repo

License

AGPL-3.0-only

Commercial (Ed25519 JWT)

Pricing

Free

€29/mo/seat

Tools

112 (basic CRUD + diagnostics)

+ ~35 (audit, compliance, fleet, backup_ops, capacity, ha, ids_advanced, qfeeds_premium)

Use case

Single-firewall ops

Multi-firewall + audit/compliance workflows

Trial token: sales@itunified.io.

Features

62 tools across 8 domains:

  • DNS/Unbound (12) — Host overrides, forwards, blocklist, cache management

  • Firewall (8) — Rules, aliases, NAT, apply changes

  • Diagnostics (8) — ARP, routes, ping, traceroute, DNS lookup, firewall states/logs

  • Interfaces (3) — List, configuration, statistics (read-only)

  • DHCP (5) — Leases, static mappings (ISC DHCPv4 + Kea dual support)

  • System (7) — Info, backup (list/download/revert), certificate listing, service control

  • ACME/Let's Encrypt (14) — Accounts, challenges, certificates, renewal, settings

  • Firmware/Plugins (5) — Version info, plugin management

Quick Start

npm install
cp .env.example .env   # Edit with your OPNsense API credentials
npm run build
node dist/index.js     # stdio transport for MCP

HashiCorp Vault Integration (Optional)

mcp-opnsense supports opportunistic AppRole authentication against a HashiCorp Vault instance. When Vault env vars are present, the server fetches OPNsense credentials from KV v2 at startup. If they are absent, the server falls back silently to direct env vars or MCP_SECRETS_FILE — no configuration change or restart required.

How It Works

  1. At startup, the server checks for NAS_VAULT_ADDR in process.env.

  2. If set, it authenticates via AppRole (NAS_VAULT_ROLE_ID + NAS_VAULT_SECRET_ID), reads the secret at <NAS_VAULT_KV_MOUNT>/data/<path>, and maps the KV fields to OPNsense env vars.

  3. If NAS_VAULT_ADDR is not set (or any Vault call fails), a single warning line is written to stderr and the server continues with whatever env vars are already available.

  4. The Vault client uses the global fetch built into Node 20+ — no additional runtime dependencies are added.

Secret Precedence

Explicit env vars  >  Vault  >  MCP_SECRETS_FILE  >  error (required var missing)
  • Values already present in process.env are never overwritten by Vault.

  • Vault is skipped entirely if NAS_VAULT_ADDR is unset.

  • MCP_SECRETS_FILE is the last fallback (see Loading Secrets from a File below).

Vault Environment Variables

Variable

Required

Description

NAS_VAULT_ADDR

Yes*

Vault server address (e.g. https://vault.example.com:8200)

NAS_VAULT_ROLE_ID

Yes*

AppRole role ID for this server

NAS_VAULT_SECRET_ID

Yes*

AppRole secret ID for this server

NAS_VAULT_KV_MOUNT

No

KV v2 mount path (default: kv)

* Only required when using Vault. Without these, the server uses direct env vars or MCP_SECRETS_FILE.

Note: OPNSENSE_VERIFY_SSL, OPNSENSE_TIMEOUT, and all SSH-related env vars (OPNSENSE_SSH_*) are not loaded from Vault. Set them directly in the MCP config or your shell environment.

KV v2 Secret Structure

The server reads from the path configured at startup (default: kv/data/opnsense/bifrost, customisable via the KV mount). The secret must contain the following keys:

# Path: kv/your/opnsense/secret
{
  "url":        "https://your-opnsense.example.com",
  "api_key":    "your-api-key",
  "api_secret": "your-api-secret"
}

Key mapping:

KV field

Env var

url

OPNSENSE_URL

api_key

OPNSENSE_API_KEY

api_secret

OPNSENSE_API_SECRET

Vault Setup

1. Write credentials to KV v2:

vault kv put kv/opnsense/your-firewall \
  url=https://your-opnsense.example.com \
  api_key=your-api-key \
  api_secret=your-api-secret

2. Create a read-only policy:

# opnsense-read.hcl
path "kv/data/opnsense/*" {
  capabilities = ["read"]
}

path "kv/metadata/opnsense/*" {
  capabilities = ["list", "read"]
}
vault policy write opnsense-read opnsense-read.hcl

3. Enable AppRole auth and create a role:

vault auth enable approle

vault write auth/approle/role/mcp-opnsense \
  token_policies="opnsense-read" \
  token_ttl=1h \
  token_max_ttl=4h \
  secret_id_ttl=0

4. Retrieve the role credentials:

vault read auth/approle/role/mcp-opnsense/role-id
vault write -f auth/approle/role/mcp-opnsense/secret-id

Store the returned role_id and secret_id in your MCP config (see example below).

Claude Desktop / MCP Config Example (Vault)

When using Vault, OPNsense credentials are not present in the config file. Only Vault authentication details and non-secret options are needed:

{
  "mcpServers": {
    "opnsense": {
      "command": "npx",
      "args": ["@itunified.io/mcp-opnsense"],
      "env": {
        "NAS_VAULT_ADDR": "https://vault.example.com:8200",
        "NAS_VAULT_ROLE_ID": "your-role-id",
        "NAS_VAULT_SECRET_ID": "your-secret-id",
        "OPNSENSE_VERIFY_SSL": "true"
      }
    }
  }
}

This keeps all OPNsense secrets out of config files and version control. The server authenticates to Vault on each startup and retrieves fresh credentials.

Claude Code Integration

Add to .mcp.json in your project root:

{
  "mcpServers": {
    "opnsense": {
      "command": "node",
      "args": ["/path/to/mcp-opnsense/dist/index.js"],
      "env": {
        "OPNSENSE_URL": "https://your-opnsense.example.com",
        "OPNSENSE_API_KEY": "your-api-key",
        "OPNSENSE_API_SECRET": "your-api-secret",
        "OPNSENSE_VERIFY_SSL": "true"
      }
    }
  }
}

Environment Variables

Variable

Required

Default

Description

OPNSENSE_URL

Yes

OPNsense base URL (e.g. https://192.168.1.1)

OPNSENSE_API_KEY

Yes

API key for authentication

OPNSENSE_API_SECRET

Yes

API secret for authentication

OPNSENSE_VERIFY_SSL

No

true

Set to false for self-signed certificates

OPNSENSE_TIMEOUT

No

30000

Request timeout in milliseconds

MCP_SECRETS_FILE

No

Path to a key/value file to load on startup (see below)

NAS_VAULT_ADDR

No

HashiCorp Vault URL, enables Vault AppRole loading (see below)

NAS_VAULT_ROLE_ID

No

Vault AppRole role_id

NAS_VAULT_SECRET_ID

No

Vault AppRole secret_id

NAS_VAULT_KV_MOUNT

No

kv

Vault KV v2 mount path

OPNSENSE_SSH_ENABLED

No

false

Enable SSH-backed tools (opnsense_if_assign, opnsense_if_configure) — see below

OPNSENSE_SSH_HOST

If SSH enabled

SSH hostname of the OPNsense target

OPNSENSE_SSH_USER

If SSH enabled

SSH login user (must have NOPASSWD sudo for the helper scripts)

OPNSENSE_SSH_KEY_PATH

If SSH enabled

Path to the private key (e.g. ~/.ssh/id_ed25519)

OPNSENSE_SSH_KNOWN_HOSTS

If SSH enabled

Path to a pre-populated known_hosts (strict checking, no TOFU)

OPNSENSE_SSH_PORT

No

22

SSH port

OPNSENSE_SSH_HELPER_DIR

No

/usr/local/opnsense/scripts/mcp

Remote directory holding if_assign.php / if_configure.php

OPNSENSE_SSH_CONNECT_TIMEOUT

No

10

SSH connect timeout in seconds

Loading Secrets from a File

When the MCP server is launched from a context that does not inherit your shell environment (e.g. a GUI desktop app launched via launchd), process.env may be empty and tool calls will fail with Invalid URL errors. To avoid system-wide environment hacks, point MCP_SECRETS_FILE at a file that holds the required variables:

export MCP_SECRETS_FILE=~/.mcp-opnsense.env

The file is a simple KEY=value format (optionally prefixed with export, with single or double quotes around values, # comments allowed). Example:

OPNSENSE_URL=https://your-opnsense.example.com
OPNSENSE_API_KEY=your-api-key
OPNSENSE_API_SECRET=your-api-secret

The OPNsense web UI "Download as .txt" button generates a two-line file with lowercase key= / secret= pairs. That format is also recognized directly — no rewriting needed:

key=your-api-key
secret=your-api-secret

Precedence: values in process.env always win over values from the file, so the existing shell-based workflow stays fully backward compatible. Missing or unreadable files are silently skipped (the server will fail with the usual "required variable" error if nothing is set).

Security: the file holds plaintext credentials. Store it outside any git repository and restrict permissions: chmod 600 ~/.mcp-opnsense.env.

Loading Secrets from HashiCorp Vault (AppRole)

If you run a central Vault instance, mcp-opnsense can fetch its credentials at startup via AppRole instead of storing them in a file. Set:

export NAS_VAULT_ADDR=https://vault.example.com
export NAS_VAULT_ROLE_ID=<role-id>
export NAS_VAULT_SECRET_ID=<secret-id>
# optional — defaults to "kv"
export NAS_VAULT_KV_MOUNT=kv

The loader reads KV v2 at <mount>/data/opnsense/bifrost and expects three keys: url, api_key, api_secret. Example Vault write:

vault kv put kv/opnsense/bifrost \
  url=https://your-opnsense.example.com \
  api_key=your-api-key \
  api_secret=your-api-secret

Precedence: process.env > Vault > MCP_SECRETS_FILE. If NAS_VAULT_ADDR is unset, Vault loading is a silent no-op — the server behaves exactly as before. On any Vault error (network, auth, missing path), a single-line warning is written to stderr and the server falls back to whatever env vars are already set; it will then fail with the usual "required variable" error if nothing remains.

Security: secret values are never logged. Only the KV path name and a populated-count appear in stderr diagnostics. The loader uses the global fetch (Node 20+) — no new runtime dependencies.

Available Tools (87)

DNS/Unbound (19 tools)

Includes DNSBL (multi-source blocklist) management — opnsense_dns_blocklist_get, opnsense_dns_blocklist_sources_list, opnsense_dns_blocklist_set — for OPNsense 26.1+.

Tool

Description

opnsense_dns_list_overrides

List host overrides (A/AAAA/CNAME)

opnsense_dns_add_override

Add a host override record

opnsense_dns_delete_override

Delete a host override by UUID

opnsense_dns_list_forwards

List DNS-over-TLS forwarding servers

opnsense_dns_add_forward

Add a DNS forwarding server

opnsense_dns_delete_forward

Delete a DNS forward by UUID

opnsense_dns_list_blocklist

List domain overrides (blocked domains)

opnsense_dns_block_domain

Block a domain

opnsense_dns_unblock_domain

Unblock a domain by UUID

opnsense_dns_flush_cache

Flush DNS cache and DNSBL data

opnsense_dns_diagnostics

Dump DNS cache for diagnostics

opnsense_dns_apply

Apply DNS changes (reconfigure Unbound)

NAT (7 tools)

Source NAT (outbound) tools wrapping /api/firewall/source_nat/* (OPNsense 26.1+):

Tool

Description

opnsense_nat_source_list

List all SNAT rules

opnsense_nat_source_get

Get a single SNAT rule by UUID

opnsense_nat_source_add

Add a SNAT rule (requires confirm: true)

opnsense_nat_source_update

Round-trip update of an existing SNAT rule (requires confirm: true)

opnsense_nat_source_delete

Delete a SNAT rule (requires confirm: true)

opnsense_nat_source_toggle

Toggle a SNAT rule's enabled state (requires confirm: true)

opnsense_nat_apply

Apply pending NAT changes (requires confirm: true)

Note: Destination NAT (port forwarding) endpoints are not yet exposed by OPNsense 26.1.7; see issue #123 for the deferred portion.

Firewall (10 tools)

Tool

Description

opnsense_fw_list_rules

List all firewall filter rules

opnsense_fw_add_rule

Create a firewall rule

opnsense_fw_update_rule

Update a firewall rule by UUID

opnsense_fw_delete_rule

Delete a firewall rule by UUID

opnsense_fw_toggle_rule

Enable/disable a firewall rule

opnsense_fw_reorder_rules

Change the evaluation order (sequence) of a rule — enforces whitelist-before-deny

opnsense_fw_drift_check

Audit rule descriptions against a regex (default: ^#\d+: issue-reference prefix)

opnsense_fw_list_aliases

List firewall aliases (host, network, port, URL)

opnsense_fw_manage_alias

Create/update/delete aliases

opnsense_fw_apply

Apply pending firewall changes

Diagnostics (12 tools)

Tool

Description

opnsense_diag_arp_table

Show ARP table (IP-to-MAC mappings)

opnsense_diag_routes

Show routing table

opnsense_diag_ping

Ping a host from OPNsense

opnsense_diag_traceroute

Traceroute to a destination

opnsense_diag_dns_lookup

Perform DNS lookup from OPNsense

opnsense_diag_fw_states

List active firewall connection states

opnsense_diag_fw_logs

Retrieve recent firewall log entries

opnsense_diag_system_info

Get system status (CPU, memory, uptime, disk)

opnsense_diag_log_system

Retrieve recent system log entries

opnsense_diag_log_gateways

Retrieve recent gateway monitoring (dpinger) log entries

opnsense_diag_log_routing

Retrieve recent routing daemon log entries

opnsense_diag_log_resolver

Retrieve recent Unbound DNS resolver log entries

Interfaces (5 tools)

Tool

Description

opnsense_if_list

List all network interfaces with device mappings

opnsense_if_get

Get detailed interface configuration

opnsense_if_stats

Get traffic statistics for all interfaces

opnsense_if_assign

SSH-backed. Assign a VLAN/NIC device to a free optN slot (gap in the OPNsense REST API)

opnsense_if_configure

SSH-backed. Set IPv4/IPv6 on an already-assigned optN slot (static, dhcp, dhcp6, track6, none)

SSH-backed interface assignment

opnsense_if_assign and opnsense_if_configure are the only tools that do not go through the OPNsense REST API. The REST API has no "Interfaces → Assignments" endpoint, so mcp-opnsense invokes two small PHP helpers over SSH + sudo instead. Both tools fail fast with a clear error if OPNSENSE_SSH_ENABLED is not true, so non-SSH deployments are unaffected.

Setup on the OPNsense host:

  1. Install the helpers (shipped in this repo under opnsense-helpers/):

    sudo install -m 0755 -o root -g wheel if_assign.php    /usr/local/opnsense/scripts/mcp/
    sudo install -m 0755 -o root -g wheel if_configure.php /usr/local/opnsense/scripts/mcp/
  2. Create a dedicated SSH user with a public key and add a sudoers.d drop-in that whitelists the exact helper invocations (see opnsense-helpers/README.md for the recommended pattern — the glob MUST end in * to accommodate the mandatory PHP -- separator).

Setup on the mcp-opnsense host:

export OPNSENSE_SSH_ENABLED=true
export OPNSENSE_SSH_HOST=your-opnsense.example.com
export OPNSENSE_SSH_USER=claude
export OPNSENSE_SSH_KEY_PATH=~/.ssh/id_ed25519
export OPNSENSE_SSH_KNOWN_HOSTS=~/.ssh/known_hosts

The known_hosts file must be pre-populated — mcp-opnsense enforces strict host key checking and will refuse to connect otherwise (no TOFU fallback).

Security posture:

  • No shell is invoked locally; the client spawns ssh directly with an argv array.

  • Arguments are single-quote-escaped before concatenation into the remote command string, so untrusted tool input cannot break out of argv on the remote side.

  • BatchMode=yes + PreferredAuthentications=publickey disables password and keyboard-interactive auth.

  • The PHP helpers validate every argument (slot regex, device regex, description charset, IP + CIDR) before touching config.xml, stamp every write_config() with mcp-opnsense: ... for audit traceability, and use numbered exit codes so the caller can distinguish "invalid args" from "write_config failed" from "apply failed".

See ADR-0092 (in the private infrastructure repo) for the full research spike, empirical findings, and rollback contract.

DHCP (5 tools)

Tool

Description

opnsense_dhcp_list_leases

List all current DHCPv4 leases (Kea + ISC, auto-detected)

opnsense_dhcp_find_lease

Search leases by IP, MAC, or hostname (Kea + ISC, auto-detected)

opnsense_dhcp_list_static

List static DHCP mappings (reservations)

opnsense_dhcp_add_static

Add a static DHCP mapping

opnsense_dhcp_delete_static

Delete a static mapping by UUID

System (7 tools)

Tool

Description

opnsense_sys_info

Get system status (hostname, versions, CPU, memory, uptime, disk)

opnsense_sys_backup_list

List all configuration backups with timestamps and descriptions

opnsense_sys_backup_download

Download configuration backup as XML (current or specific)

opnsense_sys_backup_revert

Revert to a previous configuration backup (destructive)

opnsense_sys_list_certs

List all certificates in the trust store

opnsense_svc_list

List all services and their running status

opnsense_svc_control

Start, stop, or restart a service by name

Note on tunables: opnsense_sys_tunable_* tools shipped briefly in v2026.5.6-1 (#133) were reverted in v2026.5.6-4 (#137). OPNsense exposes no public REST API for FreeBSD sysctl tunables — they live in config.xml under <sysctl> and are managed via the legacy PHP UI (System → Settings → Tunables). Tunable management can be approximated via XML-config roundtrip (opnsense_sys_backup_download + edit + opnsense_sys_backup_revert).

Note on diagnostic logs: opnsense_diag_log_{system,gateways,routing,resolver} require the API user to have Diagnostics: Logfile privilege in OPNsense (System → Access → Users). Without this privilege the endpoints return 200 OK but with "total":0. The opnsense_diag_fw_logs tool uses a separate privilege (Firewall: Diagnostics) that's typically already granted.

ACME/Let's Encrypt (14 tools)

Tool

Description

opnsense_acme_list_accounts

List ACME accounts (Let's Encrypt, ZeroSSL, etc.)

opnsense_acme_add_account

Register a new ACME account with a CA

opnsense_acme_delete_account

Delete an ACME account by UUID

opnsense_acme_register_account

Trigger registration of an ACME account with its CA

opnsense_acme_list_challenges

List all challenge/validation methods

opnsense_acme_add_challenge

Add a DNS-01 challenge (Cloudflare, AWS, etc.)

opnsense_acme_update_challenge

Update an existing challenge configuration

opnsense_acme_delete_challenge

Delete a challenge by UUID

opnsense_acme_list_certs

List all ACME certificates and their status

opnsense_acme_create_cert

Create a new certificate request

opnsense_acme_delete_cert

Delete an ACME certificate by UUID

opnsense_acme_renew_cert

Trigger immediate certificate renewal

opnsense_acme_settings

Get or update ACME service settings

opnsense_acme_apply

Apply pending ACME configuration changes

VLANs (4 tools)

Tool

Description

opnsense_vlan_list

List configured 802.1Q VLAN interfaces (parent, tag, priority, description)

opnsense_vlan_create

Create a VLAN interface on a parent device

opnsense_vlan_update

Update VLAN tag, parent, priority, or description

opnsense_vlan_delete

Delete a VLAN interface by UUID

Firmware/Plugins (8 tools)

Tool

Description

opnsense_firmware_info

Get firmware version, architecture, update status

opnsense_firmware_status

Check for available firmware upgrades

opnsense_firmware_list_plugins

List all available and installed plugins

opnsense_firmware_install

Install an OPNsense plugin package

opnsense_firmware_remove

Remove a plugin package (requires confirmation)

opnsense_firmware_upgrade

Trigger system upgrade (minor or major series jump). Long-running. Requires confirmation.

opnsense_firmware_upgrade_status

Get progress/log of a running or just-completed upgrade

opnsense_firmware_reboot

Reboot the OPNsense system. Requires confirmation.

Skills

Claude Code skills compose MCP tools into higher-level workflows. See .claude/skills/README.md for detailed documentation.

Skill

Slash Command

Description

opnsense-service-health

/opn-health

Health dashboard — system status, services, firmware, interfaces

opnsense-acme-renew

/opn-renew-cert

ACME certificate status check and renewal

opnsense-backup

/opn-backup

Configuration backup management — list, download, revert

opnsense-live-test

/opn-test

Live integration test — read + safe writes with cleanup

opnsense-diagnostics

Network connectivity diagnostics — ping, traceroute, DNS, ARP

opnsense-dns-management

DNS record management — add, delete, apply, verify resolution

opnsense-firewall-audit

Firewall security audit — permissive rules, disabled rules, patterns

Known Limitations

Some OPNsense operations are not available via the REST API and require manual GUI access:

  • Web GUI SSL certificate assignmentssl-certref can only be changed via System > Settings > Administration in the web UI. See docs/manual-operations.md.

  • Configuration upload/import — OPNsense has no API to upload configuration XML files. Use opnsense_sys_backup_revert to revert to local backups, or upload via the web GUI.

  • User/group management — Not exposed via REST API.

  • VPN configuration — Limited API coverage; most settings require the web UI.

Security

  • Transport: stdio only — no HTTP endpoints exposed

  • Authentication: OPNsense API key/secret via environment variables

  • SSL: Enabled by default, configurable for self-signed certs

  • No SSH: All operations use the OPNsense REST API exclusively

  • Input validation: Strict Zod schemas for all tool parameters

  • Destructive operations: Require explicit confirm: true parameter

  • See SECURITY.md for the full security policy

Development

npm test          # Run unit tests (vitest)
npm run build     # Compile TypeScript
npx tsc --noEmit  # Type check only

See CONTRIBUTING.md for contribution guidelines.

License

This project (mcp-opnsense, the Community Edition) is licensed under the GNU Affero General Public License v3.0 (AGPL-3.0). It is free to use under AGPL terms.

For audit, compliance, fleet, backup orchestration, capacity forecasting, advanced IDS, Q-Feeds Premium, and HA tooling, see the Business Edition: mcp-opnsense-enterprise (commercial license, €29/mo/seat).

Support development by sponsoring us on GitHub.

Available Tools

112 tools
opnsense_acme_add_accountB

Register a new ACME account with a certificate authority (Let's Encrypt, ZeroSSL, etc.). Run opnsense_acme_apply afterwards.

ParametersJSON Schema
NameRequiredDescriptionDefault
nameYesAccount name (e.g. 'Let\'s Encrypt Production')
emailYesContact email address for the account
caNoCertificate authority (default: letsencrypt)

TDQS

B3.1/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden for behavioral disclosure. It mentions 'register' (implying creation) but does not reveal whether changes require application, permissions needed, or any side effects. The note about running apply afterwards hints at delayed application but is not explicit.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is extremely concise: two sentences that state the purpose and a crucial next step. Every word earns its place with no redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no output schema, moderate parameter count (3), and sibling complexity, the description is minimally adequate. It covers the core action but lacks context on account validation, email usage, or response format.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so baseline is 3. The description does not add any parameter-specific meaning beyond what is already in the schema; it only rephrases the CA parameter as 'certificate authority' with examples, which adds minimal value.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool registers a new ACME account with a certificate authority and provides examples of CAs (Let's Encrypt, ZeroSSL). However, a sibling tool named 'opnsense_acme_register_account' exists, and the description does not differentiate between them, causing slight confusion.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides a helpful follow-up action ('Run opnsense_acme_apply afterwards'), but it does not explain when to use this tool versus alternatives like 'opnsense_acme_register_account' or when not to use it.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

opnsense_acme_add_challengeA

Add a DNS-01 challenge configuration for automated certificate validation. For Cloudflare, use the dedicated dns_cf_* fields instead of dns_environment. Run opnsense_acme_apply afterwards.

ParametersJSON Schema
NameRequiredDescriptionDefault
nameYesName for this challenge (e.g. 'Cloudflare DNS')
dns_serviceYesDNS provider service ID (e.g. 'dns_cf' for Cloudflare)
dns_environmentNoEnvironment variables for the DNS provider (for non-Cloudflare providers or custom env vars)
descriptionNoOptional description
dns_cf_tokenNoCloudflare API Token (recommended over Global API Key)
dns_cf_account_idNoCloudflare Account ID (used with API Token)
dns_cf_keyNoCloudflare Global API Key (legacy, use dns_cf_token instead)
dns_cf_emailNoCloudflare account email (used with Global API Key)
dns_cf_zone_idNoCloudflare Zone ID (optional, speeds up DNS operations)

TDQS

A4.2/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations exist, so description must disclose behavior. It states it adds a configuration but does not clarify that changes are not active until apply, though the instruction to run apply implies this. Lacks details on permission requirements or side effects.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, front-loaded with purpose, followed by a crucial usage tip and next step. No wasted words; every sentence is informative.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For an add tool with a rich schema, the description covers core behavior and key guidance. Absence of output schema is acceptable for a create operation; the follow-up action is mentioned. Could mention that it is not immediately active, but the apply instruction suffices.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Input schema has 100% coverage with descriptions for all 9 parameters. The description adds value by highlighting the Cloudflare-specific parameter usage, reducing ambiguity over which fields to use.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool adds a DNS-01 challenge configuration for certificate validation, distinguishing it from sibling tools like delete/update challenge. It specifies the resource and action unambiguously.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides guidance to use dedicated dns_cf_* fields for Cloudflare instead of dns_environment, and mentions the follow-up `opnsense_acme_apply`. Does not explicitly exclude other providers but context is clear.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

opnsense_acme_applyA

Apply pending ACME configuration changes (reconfigure service)

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description mentions 'reconfigure service', which hints at potential side effects like service restart or reload. With no annotations provided, this level of disclosure is adequate for a simple action. However, it could be more explicit about whether it applies all pending changes or just specific ones, and whether it is safe to call multiple times.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, front-loaded sentence with no filler: 'Apply pending ACME configuration changes (reconfigure service)'. Every word earns its place, achieving maximum conciseness.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool has no parameters and no output schema, the description is complete for an agent to understand its purpose and effect. The sibling tools provide additional context, but the description alone is sufficient for this simple action.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

There are no parameters, and the schema coverage is 100%. The description does not need to add parameter semantics. Baseline for zero parameters is 4.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool applies pending ACME configuration changes and reconfigures the service. It uses a specific verb ('apply') and resource ('ACME configuration changes'), and effectively distinguishes it from sibling ACME tools that handle accounts, certificates, or challenges, as well as other apply tools for different services.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implicitly indicates usage after making ACME configuration changes, but does not explicitly state when to use it versus alternatives or prerequisites. For a zero-parameter apply tool, the context is clear enough, but explicit guidance on when not to use or sequencing with other ACME tools would improve it.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

opnsense_acme_create_certA

Create a new ACME certificate request. Requires an account and challenge to be configured first. Run opnsense_acme_apply afterwards.

ParametersJSON Schema
NameRequiredDescriptionDefault
nameYesCertificate name (e.g. 'fw.example.com')
descriptionNoOptional description
alt_namesYesComma-separated Subject Alternative Names (e.g. 'fw.example.com,*.example.com')
account_uuidYesUUID of the ACME account
validation_uuidYesUUID of the challenge/validation method
key_lengthNoKey type and length (default: ec256)
auto_renewalNoEnable automatic renewal (default: true)

TDQS

A3.9/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Without annotations, the description partially discloses behavior: it creates a request (not the cert itself) and requires prerequisites. However, it doesn't detail permissions, side effects, idempotency, or what happens on duplicate names. Basic transparency but incomplete.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, no wasted words, front-loaded with the primary action. Efficient and clear.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 7-param creation tool with no output schema, the description adequately states the purpose and steps but lacks details on how to identify the created request later, potential conflicts, or error conditions. Adequate but with gaps.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% with good parameter descriptions including examples and defaults. The tool description adds no parameter-specific detail beyond the schema, so the baseline of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb 'Create', the resource 'ACME certificate request', and provides context about prerequisites and follow-up actions, distinguishing it from sibling tools like renew and apply.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly mentions prerequisites (account and challenge configured) and a required subsequent step (run apply), giving clear context for when and how to use. Does not explicitly state when not to use, but the sibling context provides implicit boundaries.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

opnsense_acme_delete_accountA

Delete an ACME account by UUID. Run opnsense_acme_apply afterwards.

ParametersJSON Schema
NameRequiredDescriptionDefault
uuidYesUUID of the account to delete

TDQS

A4.3/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Given no annotations, the description carries the burden. It discloses the destructive nature (Delete) and implies the need for a follow-up apply. It could mention the irreversible nature, but the action is clear.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, no fluff, front-loaded with the main action. Highly concise.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a single-parameter tool with clear annotations (none needed), the description is complete: what it does and the required follow-up step.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, and the description only reiterates that deletion is by UUID, adding no extra meaning. Baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action (Delete) and the resource (ACME account) with the method (by UUID), distinguishing it from sibling tools like add, list, or apply.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description advises to run 'opnsense_acme_apply afterwards', providing a necessary post-action step. While it doesn't explicitly state when to use or not use this tool, the delete context is clear.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

opnsense_acme_delete_certA

Delete an ACME certificate by UUID. Run opnsense_acme_apply afterwards.

ParametersJSON Schema
NameRequiredDescriptionDefault
uuidYesUUID of the certificate to delete

TDQS

A3.8/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided. Description conveys mutation but adds no extra behavioral context such as irreversibility, permission requirements, or side effects beyond the basic delete action.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences with no fluff. First sentence states purpose, second gives a critical follow-up action. Every word earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple delete-by-UUID tool, the description is fairly complete. It mentions the follow-up apply step. However, missing details like what happens if UUID doesn't exist or confirmation of success, but given simplicity, it's adequate.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% and the schema describes 'uuid' as 'UUID of the certificate to delete'. The tool description adds no new meaning beyond what the schema provides, so baseline 3.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states 'Delete an ACME certificate by UUID' which clearly identifies the verb (Delete), resource (ACME certificate), and method (by UUID). It distinguishes from sibling tools like create or list.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides a clear follow-up instruction: 'Run opnsense_acme_apply afterwards', which hints at the workflow. However, lacks explicit when-to-use vs. alternatives like renew or why deletion is needed.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

opnsense_acme_delete_challengeA

Delete an ACME challenge/validation method by UUID. Run opnsense_acme_apply afterwards.

ParametersJSON Schema
NameRequiredDescriptionDefault
uuidYesUUID of the challenge to delete

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description discloses the important behavioral trait that applying is needed after deletion. It could mention irreversibility or permission requirements, but the main behavioral context is covered.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, no wasted words. Front-loaded with the action and resource, followed by the necessary follow-up instruction.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple delete tool with one parameter and no output schema, the description is sufficiently complete: it explains what it does, the input, and a required post-action. No major gaps.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% with a clear description for the uuid parameter. The description adds minimal extra meaning ('by UUID') beyond the schema, so baseline score is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description explicitly states the verb 'delete' and the resource 'ACME challenge/validation method', and specifies the key identifier 'UUID'. It clearly distinguishes from siblings like add and update.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It provides a clear next step ('Run opnsense_acme_apply afterwards'), indicating a post-deletion action. It does not explicitly state when not to use the tool, but the context is sufficient.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

opnsense_acme_list_accountsA

List all ACME accounts (Let's Encrypt, ZeroSSL, etc.) configured in the os-acme-client plugin

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4.1/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description implies a read-only operation ('list all') and specifies the resource type (ACME accounts). No annotations, but the simple verb adequately conveys safety.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Single, direct sentence with no superfluous words. Highly efficient.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given zero parameters and no output schema, the description fully covers what the tool does. No missing information.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

No parameters exist, so schema coverage is 100%. The description adds no additional parameter info, but none is needed.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it lists all ACME accounts and specifies the plugin (os-acme-client), which distinguishes it from sibling tools like add, delete, or register.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No explicit guidance on when to use this tool vs. alternatives, but the purpose is obvious given sibling names (e.g., add/delete/register).

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

opnsense_acme_list_certsA

List all ACME certificates and their status (issued, pending, expired)

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A3.8/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries full burden. It states the basic action (list) but does not disclose any behavioral traits such as permission requirements, side effects, or response structure. For a simple read-only list, this is adequate but lacks depth.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence with no extraneous words. It efficiently conveys the purpose and output.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple list tool with no parameters and no output schema, the description provides sufficient context about what is listed and the status information included. However, it does not specify the format of the returned data, which could be helpful.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters, so the description need not add parameter information. With 100% schema coverage (empty schema), it is clear there are no inputs.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb 'List', the resource 'ACME certificates', and the output includes status categories (issued, pending, expired). This distinguishes it from sibling ACME tools like list_accounts, list_challenges, and CRUD operations, and from opnsense_sys_list_certs.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides no guidance on when to use this tool versus alternatives (e.g., opnsense_sys_list_certs or other list tools). No when-not or context for usage is given.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

opnsense_acme_list_challengesA

List all configured ACME challenge/validation methods (DNS-01, HTTP-01, etc.)

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries full burden. It states the action and resource but does not disclose whether the operation is read-only, requires authentication, or any side effects. For a simple list tool, this is minimally adequate.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, concise sentence that front-loads the verb and resource, with no redundant or irrelevant information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool has no parameters and no output schema, the description adequately explains what it lists. However, it could mention that it is non-destructive or provide a hint about the output format, but it is sufficiently complete for a simple listing operation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has no parameters (0), and schema coverage is 100%. The description does not need to add parameter semantics because there are none, earning a baseline of 4.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb 'List' and clearly identifies the resource as 'all configured ACME challenge/validation methods' with examples (DNS-01, HTTP-01), making it distinct from sibling tools like add/delete/update challenges.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

While the purpose is clear, the description provides no explicit guidance on when to use this tool versus alternatives (e.g., when to list challenges vs. accounts or certs). However, its role as a list operation is implicit.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

opnsense_acme_register_accountA

Trigger registration of an ACME account with its certificate authority. Use after adding an account to verify it registers successfully.

ParametersJSON Schema
NameRequiredDescriptionDefault
uuidYesUUID of the account to register

TDQS

A3.7/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries full burden for behavioral traits. It does not disclose potential side effects, idempotency, failure states, or prerequisites like network connectivity. Only a minimal action description is given.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two concise sentences, no redundant words. The first sentence states the action, the second provides usage context. Ideal structure.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple one-parameter trigger tool, the description covers purpose and usage but lacks detail on return values or verification method. It mentions verifying successful registration but does not specify output, leaving a minor completeness gap.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so baseline is 3. The description does not add extra meaning beyond the schema's parameter description, which already states 'UUID of the account to register'.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the specific verb ('trigger registration') and resource (ACME account with its CA), and distinguishes from sibling tools like 'add_account' by noting it is used after adding an account.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides clear when-to-use guidance: 'Use after adding an account to verify it registers successfully.' It implies the prerequisite (add_account) but does not explicitly list alternatives or when not to use.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

opnsense_acme_renew_certA

Trigger immediate renewal/signing of an ACME certificate by UUID

ParametersJSON Schema
NameRequiredDescriptionDefault
uuidYesUUID of the certificate to renew

TDQS

A3.5/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, and the description only says 'Trigger immediate renewal/signing', which is minimal. It does not disclose side effects (e.g., whether the certificate is applied, if services restart, or if the renewal is irreversible). The agent is left uninformed about important behavioral traits.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence of 9 words, front-loading the action and resource. No wasted words; it is appropriately concise.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple 1-param tool, the description covers the basic purpose. However, given the lack of annotations and the potentially impactful nature of renewing certificates (affecting services), additional context about preconditions or post-effects would be beneficial.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema covers 100% of parameters, already describing 'uuid' as 'UUID of the certificate to renew'. The description adds 'by UUID', which reinforces but does not add meaning beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description 'Trigger immediate renewal/signing of an ACME certificate by UUID' clearly states the action (trigger renewal/signing) and the resource (ACME certificate). It distinguishes from sibling tools like opnsense_acme_create_cert (create) and opnsense_acme_list_certs (list).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage by mentioning 'by UUID', but it does not explicitly state when to use this tool versus alternatives like creation or listing. No 'when to use' or 'when not to use' guidance is provided.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

opnsense_acme_settingsA

Get or update ACME service settings (enable/disable, environment, auto-renewal, log level). When called with no parameters, returns current settings. Run opnsense_acme_apply afterwards when updating.

ParametersJSON Schema
NameRequiredDescriptionDefault
enabledNoEnable (1) or disable (0) the ACME service
environmentNoACME environment: prod (production) or stg (staging)
autoRenewalNoEnable (1) or disable (0) automatic certificate renewal
logLevelNoLog verbosity level

TDQS

A4.2/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided, so description carries full burden. It discloses that with no params it returns current settings, but lacks details on side effects of updates, error conditions, or permission requirements. Adequate but not thorough.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, front-loaded with purpose, no redundant information. Every word earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

No output schema, but description mentions return of current settings. Mentions follow-up apply tool. Could be more specific about return format, but sufficient for common use.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema covers all parameters with full descriptions and enums (100% coverage). Description adds value by explaining that calling with no parameters returns current settings, which is not evident from schema alone.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description clearly states 'Get or update ACME service settings' with specific fields (enable/disable, environment, auto-renewal, log level). Distinguishes from sibling tools like opnsense_acme_apply by mentioning it should be run afterwards.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly says when to use: get current settings with no parameters, or update settings. Provides guidance to run opnsense_acme_apply after updates. Lacks explicit when-not-to-use guidance, but context is clear.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

opnsense_acme_update_challengeA

Update an existing ACME challenge/validation by UUID. Use to change credentials or settings. Run opnsense_acme_apply afterwards.

ParametersJSON Schema
NameRequiredDescriptionDefault
uuidYesUUID of the challenge to update
nameNoUpdated name
dns_serviceNoDNS provider service ID
dns_environmentNoEnvironment variables
descriptionNoUpdated description
dns_cf_tokenNoCloudflare API Token
dns_cf_account_idNoCloudflare Account ID
dns_cf_keyNoCloudflare Global API Key
dns_cf_emailNoCloudflare account email
dns_cf_zone_idNoCloudflare Zone ID

TDQS

A4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries full transparency burden. It discloses that the tool performs a write operation and requires a separate apply step to commit changes, but does not mention error handling, permissions, or what happens if the UUID does not exist.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two concise sentences: first states the action and identifier, second gives usage context and a critical follow-up step. No redundancy, front-loaded with key information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Covers purpose, usage context, and a necessary post-step. The lack of an output schema is partially mitigated by the clear mutation nature, but missing details about error scenarios or prerequisites (e.g., UUID must exist) prevent a perfect score.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so baseline is 3. The description adds context by grouping parameters as 'credentials or settings', but does not elaborate beyond what the schema already provides for each parameter.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Clearly states the action ('Update'), the resource ('existing ACME challenge/validation'), and the identifier method ('by UUID'). Mentions what can be changed ('credentials or settings'), and distinguishes from sibling tools like opnsense_acme_add_challenge (create) and opnsense_acme_delete_challenge (delete) by focusing on updates.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides explicit guidance on when to use ('to change credentials or settings') and a necessary follow-up action ('Run opnsense_acme_apply afterwards'). Implicitly differentiates from add/delete siblings, though it lacks explicit 'when not to use' statements.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

opnsense_dhcp_add_staticA

Add a static DHCP mapping (MAC-to-IP reservation). Supports both Kea DHCP and ISC DHCP (legacy) backends — auto-detected. Requires DHCP service restart to take effect.

ParametersJSON Schema
NameRequiredDescriptionDefault
macYesMAC address (format: AA:BB:CC:DD:EE:FF)
ipaddrYesIP address to assign
hostnameNoOptional hostname for the mapping
descriptionNoOptional description

TDQS

A3.9/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries full burden. It discloses that a DHCP service restart is required for the mapping to take effect, which is a key behavioral trait. However, it does not disclose whether overwriting existing mappings is allowed, potential conflicts, or error handling. This is adequate but not comprehensive.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, front-loaded with purpose, then backend and restart info. Every sentence earns its place with no fluff. Well-structured and efficient.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

No output schema exists, so the description should ideally explain return values. It mentions behavior (restart requirement) but not what the tool returns or prerequisite conditions. It is adequate for a simple mutation tool but could be more complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so baseline is 3. The description adds no parameter-specific details beyond what the schema provides (e.g., MAC format, IP address, optional hostname/description). No extra value is added.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it adds a static DHCP mapping (MAC-to-IP reservation). It distinguishes from sibling tools like opnsense_dhcp_delete_static and opnsense_dhcp_list_static by specifying 'Add' and the resource. The mention of backend support and restart requirement adds further clarity.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage for adding static DHCP mappings and mentions backend auto-detection, but it does not explicitly compare to alternatives or state when not to use. It provides clear context but lacks explicit exclusions or sibling differentiation.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

opnsense_dhcp_delete_staticA

Delete a static DHCP mapping by UUID. Supports both Kea DHCP and ISC DHCP (legacy) backends — auto-detected.

ParametersJSON Schema
NameRequiredDescriptionDefault
uuidYesUUID of the static mapping to delete

TDQS

A3.6/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations are absent, so the description carries full burden. It discloses backend auto-detection, but does not mention permanence of deletion, error handling, or need to apply changes.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, no wasted words, front-loaded with the core action. Highly concise and clear.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Adequate for a simple delete tool with one parameter. Covers action, identifier, and backend support. Could mention result or effect on backend, but not critical.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, and the description does not add meaning beyond the schema's parameter description. Baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action (delete), the resource (static DHCP mapping), and the identifier (UUID). It also mentions backend support, distinguishing it from sibling tools like add/list.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this tool versus alternatives, such as when to delete vs. list or add. It does not provide context or prerequisites.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

opnsense_dhcp_find_leaseA

Search DHCPv4 leases by IP address, MAC address, or hostname. Supports both Kea DHCP and ISC DHCP (legacy) backends — auto-detects which is active.

ParametersJSON Schema
NameRequiredDescriptionDefault
queryYesSearch term — IP address, MAC address, or hostname

TDQS

A4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Discloses backend support and auto-detection behavior, which is valuable. However, with no annotations, the description carries full burden. It does not mention read-only nature, return format, or error handling, leaving some behavioral gaps.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two efficient sentences with no wasted words. The key information is front-loaded, and every sentence serves a purpose.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the simplicity of the tool and no output schema, the description is fairly complete. It covers purpose, search criteria, and backend handling. Missing details on return format (single vs multiple) and error responses, but overall adequate for a one-param search tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% with a clear parameter description matching the tool description. Description adds no new meaning beyond what the schema already provides, so baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description clearly states the verb 'Search' and the resource 'DHCPv4 leases' with specific searchable attributes (IP, MAC, hostname). It also differentiates from sibling tools like list_leases by implying a focused search operation.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides clear context on what it searches and mentions backend auto-detection, but does not explicitly state when to use this tool versus alternatives like list_leases or when not to use it. The context is clear but lacks explicit exclusions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

opnsense_dhcp_list_leasesA

List all current DHCPv4 leases. Supports both Kea DHCP (default on modern OPNsense) and ISC DHCP (legacy) backends — auto-detects which is active.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4.1/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description must disclose behavioral traits. It states it lists leases and auto-detects backends, but does not explicitly note it is read-only or non-destructive. For a simple list tool, this is minimally adequate.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two concise sentences with no extraneous information. The description is front-loaded with the core action and efficiently adds backend details.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers the core purpose and backend handling, but lacks details on output format, prerequisites, or any side effects. Given no output schema, more context would be helpful.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has no parameters, so the description cannot add parameter semantics. However, it adds value by explaining backend support beyond the empty schema, earning a high score.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool lists DHCPv4 leases and specifies support for both Kea and ISC backends. It distinguishes from siblings like find_lease and static lease tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly covers backend auto-detection, useful for users unsure which DHCP is active. However, it does not mention when to avoid this tool in favor of siblings like opnsense_dhcp_find_lease.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

opnsense_dhcp_list_staticA

List all static DHCP mappings (MAC-to-IP reservations). Supports both Kea DHCP and ISC DHCP (legacy) backends — auto-detected.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries full burden. It explains the tool lists all static mappings and auto-detects backends, but does not disclose permissions needed, whether it reads from config or runtime, or the output format. Basic but adequate for a simple list operation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single concise sentence that states the purpose and adds backend support information without any redundant or unnecessary words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no parameters and no output schema, the description is fairly complete for a list tool. It could mention the structure of the returned list, but for a straightforward tool it is adequate.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has no parameters (100% coverage), so the description adds no parameter-specific information, which is appropriate. A baseline of 4 is justified for zero-parameter tools.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool lists static DHCP mappings (MAC-to-IP reservations) and specifies support for both Kea and ISC DHCP backends. It distinguishes itself from siblings like opnsense_dhcp_list_leases (dynamic leases) and opnsense_dhcp_add_static (adding mappings).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description does not explicitly state when to use this tool versus alternatives like opnsense_dhcp_list_leases or opnsense_dhcp_add_static. While it mentions backend support, it lacks guidance on prerequisites or when not to use it.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

opnsense_diag_arp_tableA

Show the ARP table (IP-to-MAC mappings). Optionally filter by IP, MAC, or interface.

ParametersJSON Schema
NameRequiredDescriptionDefault
ipNoFilter by IP address
macNoFilter by MAC address
interfaceNoFilter by interface name

TDQS

A3.8/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided, so the description must convey behavior. It correctly indicates a read operation ('Show') and optional filtering. Does not mention permissions, output format, or side effects, but this aligns with the simplicity of the tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Single sentence with no fluff. Front-loads the primary action ('Show the ARP table') and appends the option for filtering. Every word adds value.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple read-only diagnostic tool with three optional filters and no output schema, the description is sufficient. It covers what the tool does and the filtering capabilities. A higher score would require more detail on output format or behavior, but it is not necessary here.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% with each parameter described. The description adds no new information beyond 'optionally filter by IP, MAC, or interface', so baseline score of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Clearly states the verb 'Show' and resource 'ARP table' with the clarifying parenthetical 'IP-to-MAC mappings', making the purpose unmistakable. It is distinct from sibling diag tools like DNS lookup or ping.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Implied usage: retrieving ARP table entries, optionally filtered. No explicit when-not-to-use or alternatives, but the name and description suffice for a simple read operation.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

opnsense_diag_dns_lookupB

Perform a DNS lookup from the OPNsense firewall

ParametersJSON Schema
NameRequiredDescriptionDefault
hostnameYesHostname to look up

TDQS

B3.1/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Without annotations, the description must disclose behavioral traits. It only states 'perform a DNS lookup' but omits details like whether it uses cached data, respects TTLs, required network connectivity, or output format. This is insufficient for an agent to predict behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, efficient sentence with no wasted words. It is front-loaded with the key action. However, it could be slightly more informative without losing conciseness.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's simplicity (1 param, no output schema, no annotations), the description should at least mention return format or side effects. It fails to provide enough context for an agent to use it correctly without external knowledge.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% (hostname described in schema). The description adds no extra meaning beyond the schema. Baseline 3 is appropriate for a simple single-parameter tool.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's verb (Perform), resource (DNS lookup), and context (from the OPNsense firewall). It distinguishes itself from sibling tools like opnsense_diag_reverse_dns by implying forward lookup.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides no guidance on when to use this tool versus alternatives like opnsense_diag_reverse_dns, ping, or traceroute. No mention of prerequisites, limitations, or context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

opnsense_diag_fw_logsB

Retrieve recent firewall log entries

ParametersJSON Schema
NameRequiredDescriptionDefault
limitNoNumber of log entries to retrieve (default: 50, max: 5000)

TDQS

B3.2/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, and the description only mentions 'recent' without specifying recency criteria, pagination, or whether the operation is read-only. Behavioral traits such as authentication requirements, rate limits, or response format are not disclosed.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single concise sentence with no unnecessary words. It communicates the essential purpose efficiently.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no output schema, the description fails to indicate the structure of returned log entries (e.g., fields like timestamp, source, action). Without this, an agent cannot interpret the output correctly. The tool is simple but the description lacks completeness for effective use.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema covers the 'limit' parameter with full description of default and max values. The description adds no additional meaning beyond what the schema already provides, so baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description 'Retrieve recent firewall log entries' clearly states a specific verb ('retrieve') and resource ('firewall log entries'), and distinguishes this tool from other diagnostic log tools by focusing on firewall logs.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is provided on when to use this tool versus alternative log retrieval tools (e.g., opnsense_diag_log_gateways, opnsense_diag_log_system). The description does not indicate any prerequisites, limitations, or when not to use it.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

opnsense_diag_fw_statesA

List active firewall connection tracking states

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4.1/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided, so description carries full burden. It indicates a read-only listing operation, which is safe and non-destructive, but lacks details on potential performance impact or authorization requirements.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Single sentence description is concise and front-loaded with key information. No wasted words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple list tool with no parameters, the description is complete. It could mention that it returns state table entries, but the name and description already imply that.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters, so no parameter documentation is needed. The description is sufficient.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description 'List active firewall connection tracking states' clearly states the tool's purpose with a specific verb (List), resource (firewall connection tracking states), and action. It effectively differentiates from sibling diagnostic tools like ARP table listing.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No explicit guidance on when to use this versus other diagnostic tools. However, the name and description imply usage for inspecting current firewall states, which is adequate for a zero-parameter tool.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

opnsense_diag_log_gatewaysA

Retrieve recent OPNsense gateway monitoring (dpinger) log entries — useful for WAN/gateway health debugging.

ParametersJSON Schema
NameRequiredDescriptionDefault
limitNoNumber of log entries (1-5000, default 500)

TDQS

A3.6/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided, so description carries full burden. Only mentions 'recent' entries but lacks details on safety (read-only), side effects, or rate limits. Minimal behavioral disclosure.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Focused single sentence with no extraneous words. Front-loaded with the key action and resource.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Adequate for a simple log retrieval tool with one parameter. Could hint at output format but not critical given the tool's straightforward nature.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% for the single parameter 'limit', with a clear description in the schema. Description does not add additional meaning beyond what the schema already provides.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description clearly states the action ('Retrieve'), resource ('gateway monitoring log entries'), and purpose ('WAN/gateway health debugging'). It distinguishes from sibling log tools like opnsense_diag_log_resolver by specifying the gateway/dpinger source.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Implied usage for gateway health debugging but no explicit guidance on when to use this versus other diagnostic tools or when not to use it.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

opnsense_diag_log_resolverB

Retrieve recent Unbound DNS resolver log entries.

ParametersJSON Schema
NameRequiredDescriptionDefault
limitNoNumber of log entries (1-5000, default 500)

TDQS

B3.3/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description fails to disclose what 'recent' means, any side effects, or whether the operation is read-only. The description is too brief to cover behavioral traits.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, clear sentence that efficiently conveys the purpose without extraneous words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's simplicity (one optional parameter, no output schema), the description is adequate but could benefit from noting the default limit or that entries are from the tail of the log.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so baseline is 3. The description adds no additional meaning beyond the schema's parameter description for 'limit'.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb (retrieve), resource (Unbound DNS resolver log entries), and differentiates from sibling diag_log_* tools by specifying the log source.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this tool vs alternatives like opnsense_diag_log_system or opnsense_diag_dns_lookup is provided.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

opnsense_diag_log_routingB

Retrieve recent OPNsense routing daemon log entries.

ParametersJSON Schema
NameRequiredDescriptionDefault
limitNoNumber of log entries (1-5000, default 500)

TDQS

B3.2/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description must disclose behavioral traits. It only states 'Retrieve... log entries,' implying a read operation, but does not specify whether logs are paginated, how errors are handled, or any rate limits. The limit parameter suggests pagination but is not explained.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence that directly states the purpose, followed by an implicit parameter note. It is front-loaded and free of unnecessary words. However, it could be slightly expanded without being verbose.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool has only one parameter and no output schema, the description covers the basic purpose but lacks usage guidelines and behavioral details. It does not help the agent differentiate from sibling log tools, which is a gap for a diagnostic tool in a set of similar tools.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, with the single parameter 'limit' already documented (number, range 1-5000, default 500). The tool description adds no further meaning beyond the schema, so baseline score of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool retrieves recent OPNsense routing daemon log entries. The verb 'Retrieve' and resource 'routing daemon log entries' are specific, and it distinguishes from sibling tools like opnsense_diag_log_system or opnsense_diag_routes by focusing on routing daemon logs.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides no guidance on when to use this tool versus other diag log tools (e.g., opnsense_diag_log_gateways, opnsense_diag_log_resolver). There is no mention of typical use cases or exclusions, leaving the agent to infer context solely from the tool name.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

opnsense_diag_log_systemA

Retrieve recent OPNsense system log entries (kernel, generic system events).

ParametersJSON Schema
NameRequiredDescriptionDefault
limitNoNumber of log entries (1-5000, default 500)

TDQS

A3.5/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description must fully disclose behavior. It mentions 'recent' but does not specify the time window, pagination, ordering, or whether entries are sorted chronologically. The return format is omitted, which limits transparency.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single concise sentence that immediately conveys the tool's purpose with no wasted words. It is front-loaded and easy to parse.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple log retrieval tool with one parameter, the description is mostly complete but lacks details about the output format (e.g., JSON array of lines). Without an output schema, more context about return structure would improve completeness.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema provides full description for the only parameter 'limit' (1-5000, default 500). The description adds no additional meaning beyond the schema, achieving baseline adequacy.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool retrieves recent OPNsense system log entries, specifying the resource (system log entries) and scope (kernel, generic system events). It effectively distinguishes itself from sibling log tools like opnsense_diag_log_gateways and opnsense_diag_log_resolver.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies use for system logs, but lacks explicit guidance on when to use this tool versus alternatives (e.g., gateways, resolver logs). No when-not-to-use or prerequisites are mentioned.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

opnsense_diag_pingB

Ping a host from the OPNsense firewall

ParametersJSON Schema
NameRequiredDescriptionDefault
addressYesIP address or hostname to ping
countNoNumber of ping packets (default: 3, max: 100)

TDQS

B3.4/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, yet the description fails to disclose behavioral traits such as permissions, side effects, or that it is a read-only operation, leaving a significant gap.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single efficient sentence without wasted words, though it could provide slightly more context without becoming verbose.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple two-parameter tool with no output schema, the description is minimally adequate; it does not explain return values or expected output format, but ping behavior is widely understood.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the description adds no additional meaning beyond what is already in the schema, achieving the baseline score.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb 'ping', resource 'host', and scope 'from the OPNsense firewall', distinguishing it from sibling diagnostic tools like dns_lookup and traceroute.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage for network connectivity testing but provides no explicit guidance on when to use this tool versus alternatives like traceroute or when not to use it.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

opnsense_diag_reverse_dnsA

Perform a reverse DNS lookup (IP to hostname) from the OPNsense firewall

ParametersJSON Schema
NameRequiredDescriptionDefault
addressYesIP address to reverse-lookup

TDQS

A3.5/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description must fully disclose behavioral traits. It only states the action without mentioning error handling, timeout, network dependencies, or what the response contains. This lack of detail limits transparency for the agent.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence of 11 words, efficiently conveying the tool's purpose without redundancy. It is front-loaded and uses clear language, earning its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple one-parameter tool with no output schema, the description adequately explains the function but lacks details on return value format, potential failures, or prerequisites. This incomplete context may hinder full autonomous usage.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema already describes the 'address' parameter with 100% coverage. The description reinforces that the address is an IP for reverse lookup, adding no new semantic information beyond the schema. Baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool performs a reverse DNS lookup (IP to hostname) from the OPNsense firewall. The verb 'Perform' and the specific resource 'OPNsense firewall' clarify the action. The sibling 'opnsense_diag_dns_lookup' is for forward lookup, so this description effectively distinguishes the tool's purpose.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage for reverse DNS lookup but does not explicitly state when to use this tool over alternatives like 'opnsense_diag_dns_lookup' (forward lookup) or other diagnostic tools. There is no guidance on conditions or exclusions, leaving the agent to infer from the name.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

opnsense_diag_routesA

Show the routing table

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A3.6/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the minimal description fails to disclose that this is a read-only diagnostic operation. It does not mention permissions, output format, or any side effects, requiring the agent to infer safety.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single concise sentence without any redundancy. Perfectly sized for a trivial zero-parameter read tool.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Adequate for a simple diagnostic tool with no parameters or output schema. Could clarify it shows the current system routing table, but the current level is sufficient.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has no parameters, and the schema coverage is 100% (by default). The description adds no parameter info, but none is needed; baseline for 0 params is 4.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description 'Show the routing table' uses a specific verb ('Show') and resource ('routing table'), clearly distinguishing it from siblings like opnsense_route_list (configured routes) and opnsense_diag_arp_table (ARP table).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this tool versus alternatives such as opnsense_route_list. It does not explain that it displays the dynamic/kernel routing table, not static routes, leaving potential confusion.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

opnsense_diag_system_infoA

Get system status information (CPU, memory, uptime, disk, versions)

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden. It honestly lists the information categories returned, which is sufficient for a diagnostic read-only tool. However, it does not mention authentication needs or error conditions.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Single concise sentence with specific details in parentheses. No wasted words; front-loaded with the action and resource.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple diagnostic tool with no parameters and no output schema, the description provides sufficient context. It could mention output format or safety, but the current version is adequate for an agent to decide when to use it.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema is empty, and schema coverage is 100%. With zero parameters, the baseline is 4, and the description adds no additional parameter information, which is acceptable.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb 'Get' and the resource 'system status information' with specific examples (CPU, memory, uptime, disk, versions). This distinguishes it from sibling diagnostic tools like ping, traceroute, or firewall logs.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage for general system health checks, but does not explicitly contrast with the similar sibling 'opnsense_sys_info', which may cause slight ambiguity. It provides clear context but lacks exclusionary guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

opnsense_diag_tracerouteB

Run a traceroute from the OPNsense firewall to a destination

ParametersJSON Schema
NameRequiredDescriptionDefault
addressYesIP address or hostname to traceroute

TDQS

B3.1/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided, so description must fully disclose behavior. It does not mention that traceroute is potentially long-running, requires network access, or that it is a read-only operation. No details on timeouts, rate limits, or error handling.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Single sentence, concise and front-loaded. However, for a simple tool, the brevity is appropriate; no wasted words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

No output schema, yet description does not explain return values or format. Given many sibling diagnostic tools, additional context about use cases or output would improve completeness.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Input schema covers 100% of parameters, with address described as 'IP address or hostname to traceroute'. Description adds no extra semantics beyond the schema, meeting baseline expectations.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description clearly states the action (run a traceroute) and the resource (from the OPNsense firewall to a destination). Among sibling diagnostic tools like ping, dns_lookup, and arp_table, it uniquely identifies the traceroute functionality.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this tool versus other diagnostic tools (e.g., ping, routes). No mention of prerequisites, error conditions, or alternative tools for similar tasks.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

opnsense_dns_add_forwardA

Add a DNS forwarding server (DNS-over-TLS). Run opnsense_dns_apply afterwards to activate.

ParametersJSON Schema
NameRequiredDescriptionDefault
domainYesDomain to forward (e.g. 'example.com')
serverYesDNS server IP address
portNoDNS server port (default: 53)

TDQS

A4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries full burden. It notes the need for an activation step, but omits other behavioral details like whether it overwrites existing forwards, permission requirements, or idempotency. Minimal but not misleading.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, no filler. First sentence states purpose, second provides critical follow-up action. Extremely efficient and well-structured for quick comprehension.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple 3-parameter tool with no output schema, the description covers primary action, protocol, and post-step. Lacks edge case handling (e.g., duplicate entries) but sufficient for standard usage given sibling context.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Input schema covers all three parameters with descriptions. The tool description adds no additional parameter meaning beyond 'port' default (53) implied in schema; baseline score of 3 is appropriate due to full schema coverage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description clearly states the action ('Add a DNS forwarding server'), specifies protocol (DNS-over-TLS), and distinguishes from sibling tools like opnsense_dns_delete_forward and opnsense_dns_list_forwards. The verb-resource combination is specific and unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly instructs to run opnsense_dns_apply afterwards to activate, which is a key post-step. However, it does not compare with alternative add tools (e.g., opnsense_dns_add_override) or specify when not to use this tool.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

opnsense_dns_add_overrideA

Add a DNS host override (A/AAAA/CNAME record) to Unbound. Run opnsense_dns_apply afterwards to activate.

ParametersJSON Schema
NameRequiredDescriptionDefault
hostnameYesHostname (e.g. 'myserver')
domainYesDomain (e.g. 'home.lab')
serverYesTarget IP address
descriptionNoOptional description
typeNoRecord type (default: A)

TDQS

A3.5/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided, and description omits side effects (e.g., overwrites existing record? requires permissions?), leaving behavioral traits unclear for a write operation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two concise, front-loaded sentences with no redundant information, efficiently conveying purpose and necessary follow-up action.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Covers the add-and-apply workflow, but lacks error behavior and idempotency details; for a simple creation tool without output schema, it is adequate but not fully complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

All parameters already described in schema (100% coverage); description adds no extra meaning beyond restating record types already in enum.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description clearly states 'Add a DNS host override (A/AAAA/CNAME record) to Unbound' with specific verb and resource, distinguishing it from siblings like add_forward and block_domain.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It mentions the follow-up step 'Run opnsense_dns_apply afterwards to activate,' which is helpful, but lacks when-to-use versus alternatives or exclusions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

opnsense_dns_applyA

Apply pending DNS/Unbound configuration changes (reconfigure service)

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A3.6/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description must disclose behavioral traits. It mentions 'reconfigure service' which implies potential service restart, but it does not state side effects, permission requirements, or idempotency. The description is minimal and lacks important behavioral context.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, clear sentence that efficiently conveys the tool's purpose. It is front-loaded and concise, but could potentially include more detail without becoming overly long.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's simplicity (no parameters, no output schema), the description is adequate but leaves gaps in behavioral context and usage guidance. It covers the core purpose but lacks completeness for an agent to fully understand implications.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

There are no parameters, and schema description coverage is trivially 100%. Per the rubric, 0 parameters warrants a baseline score of 4. The description adds no parameter information because none exist.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool applies pending DNS/Unbound configuration changes by reconfiguring the service. It uses a specific verb ('apply') and resource ('pending DNS/Unbound configuration changes'), effectively distinguishing it from sibling apply tools like opnsense_fw_apply or opnsense_nat_apply.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

While the name and description imply usage after making DNS modifications, there is no explicit guidance on when to use this tool over alternatives or any prerequisites. The context of sibling apply tools suggests differentiation but does not provide clear when-to-use or when-not-to-use instructions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

opnsense_dns_block_domainA

Block a domain by adding a domain override with an empty server. Run opnsense_dns_apply afterwards to activate.

ParametersJSON Schema
NameRequiredDescriptionDefault
domainYesDomain to block (e.g. 'ads.example.com')
serverNoServer to redirect to (empty string = block, default: empty)
descriptionNoOptional description

TDQS

A4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description must fully disclose behavior. It correctly indicates a mutation (block) and the two-step process (add then apply). However, it does not discuss potential side effects like overwriting existing overrides, permission requirements, or rate limits. The transparency is adequate but not rich.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is extremely concise: one sentence stating the action and mechanism, plus a short instruction. It is front-loaded and contains no superfluous information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple blocking tool, the description covers purpose, mechanism, and critical activation step. It lacks information on handling duplicates, confirmation, or return values (no output schema), so a minor gap exists. Overall, it is complete enough for the task.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema already provides full descriptions for all three parameters (100% coverage). The description reinforces that server defaults to empty (block) and description is optional, adding minimal value beyond the schema. Baseline of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool blocks a domain by adding a domain override with an empty server, and mentions the required follow-up action (apply). This verb+resource+mechanism clearly distinguishes it from siblings like opnsense_dns_add_override and opnsense_dns_unblock_domain.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The instruction to run opnsense_dns_apply afterwards provides clear activation context. However, it does not explicitly state when to use this tool vs alternatives (e.g., unblocking or setting a non-empty server), leaving some implicit inference from the tool name and sibling list.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

opnsense_dns_blocklist_getA

Get the Unbound DNSBL (DNS blocklist) configuration: enabled flag, selected built-in source IDs, custom URLs, NX-domain mode, allowlist. Read-only.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description adds value by stating 'Read-only', indicating the tool does not modify state. It does not detail authentication or rate limits, but this is acceptable for a simple read operation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence with no wasted words, front-loaded with the action and resource, and immediately followed by specific details.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given there are no parameters, no output schema, and the tool is a simple getter, the description comprehensively lists all configuration elements returned, making it fully adequate.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters, so schema coverage is irrelevant. The description supplements by listing what the returned configuration includes, adding meaning beyond the empty schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb 'Get' and resource 'Unbound DNSBL configuration', listing exact components (enabled flag, source IDs, custom URLs, NX-domain mode, allowlist) and stating 'Read-only', which clearly distinguishes it from sibling tools like opnsense_dns_blocklist_set.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The 'Read-only' note implies it is for inspection, and sibling tool names (e.g., opnsense_dns_blocklist_set) suggest when to use alternatives, but no explicit when/when-not guidance is provided.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

opnsense_dns_blocklist_setA

Update the Unbound DNSBL configuration: enable/disable, select multiple built-in source IDs, set custom blocklist URLs, configure NX-domain mode. After this, call opnsense_dns_apply to activate. DESTRUCTIVE: requires explicit confirmation.

ParametersJSON Schema
NameRequiredDescriptionDefault
enabledNoMaster enable for the DNSBL feature
sourcesNoList of built-in source IDs to enable (use opnsense_dns_blocklist_sources_list to discover available IDs, e.g. 'hgz002', 'sb', 'ag')
custom_listsNoComma- or newline-separated list of custom blocklist URLs (one per line)
nxdomainNoReturn NXDOMAIN instead of 0.0.0.0 for blocked entries
confirmYesMust be true to apply the change

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided, so the description carries the burden. It explains the tool modifies configuration, requires confirmation, and requires a follow-up apply. It could elaborate on merge vs replace behavior, but is sufficient.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three sentences: first states purpose and parameters, second gives critical follow-up instruction, third is a warning. No redundant information, front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no output schema and siblings that retrieve data, the description provides necessary context: how to discover source IDs via another tool, the need for apply, and destructive nature. Minor gap: whether changes replace or merge existing config, but overall complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, but the description adds significant value by explaining parameter usage (e.g., 'enable/disable' for enabled, cross-reference to opnsense_dns_blocklist_sources_list for sources, and clarifying that confirm must be true).

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool updates Unbound DNSBL configuration, listing specific actions like enable/disable, select sources, set URLs, configure NXDOMAIN. This distinguishes it from sibling read tools like opnsense_dns_blocklist_get.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly says to call opnsense_dns_apply after to activate, and warns 'DESTRUCTIVE: requires explicit confirmation.' It does not contrast with alternatives, but the purpose is clear enough.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

opnsense_dns_blocklist_sources_listA

List all available built-in DNSBL block-list sources (curated feeds like AdGuard, EasyList, hagezi, Steven Black, etc.) with their internal IDs and selected state. Read-only.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4.3/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided. The description declares the tool as read-only and lists the output (IDs and selected state). It does not disclose additional behavioral traits like authentication requirements or rate limits, but for a simple list operation, this is minimally acceptable.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence with parenthetical examples. It is front-loaded with the action and resource, and every word adds value. No fluff or redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no output schema and no parameters, the description comprehensively explains the tool's purpose, input (none), and output (IDs and selected state). It is fully complete for a list operation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has no parameters, and schema coverage is 100%. The description adds value by explaining what data is returned (internal IDs and selected state) beyond what the schema provides. Following the rule '0 params = baseline 4', this score is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it lists all available built-in DNSBL block-list sources, with examples like AdGuard, EasyList, and Steven Black. It specifies output includes internal IDs and selected state, and notes it is read-only. This distinguishes it from sibling tools like opnsense_dns_list_blocklist, which likely lists blocklists rather than sources.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage for listing sources before enabling them, but does not explicitly state when not to use this tool or mention alternatives. However, it is clear that this is for listing sources, not for managing blocklists, which is adequate given the sibling context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

opnsense_dns_delete_forwardA

Delete a DNS forwarding entry by UUID. Run opnsense_dns_apply afterwards to activate.

ParametersJSON Schema
NameRequiredDescriptionDefault
uuidYesUUID of the forwarding entry to delete

TDQS

A4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It discloses that deletion requires a separate apply to activate, which is important behavioral context. However, it does not mention reversibility, permissions, or side effects beyond the immediate deletion.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is extremely concise at two sentences, with the primary action front-loaded. Every sentence earns its place without unnecessary detail.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's simplicity (one parameter, no output schema) and the use of a companion apply tool, the description provides enough context for an agent to understand the operation and required sequence. Minor gap: no guidance on sourcing the UUID.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 100% description coverage for the single 'uuid' parameter. The description reiterates the parameter usage ('by UUID') but adds no additional semantic meaning beyond what the schema provides. Baseline score of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action (delete), the resource (DNS forwarding entry), and the input method (by UUID). It distinguishes from sibling tools like opnsense_dns_add_forward and opnsense_dns_list_forwards.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly indicates when to use the tool (to delete a forwarding entry) and the required follow-up action (apply after delete). It does not provide exclusions or alternatives, but for a delete operation, this is sufficient.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

opnsense_dns_delete_overrideA

Delete a DNS host override by UUID. Run opnsense_dns_apply afterwards to activate.

ParametersJSON Schema
NameRequiredDescriptionDefault
uuidYesUUID of the host override to delete

TDQS

A4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description must disclose behavioral traits. It correctly indicates that deletion requires a separate apply step for activation. However, it does not mention if the deletion is permanent, reversible, or requires specific privileges, leaving some gaps.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is exceptionally concise: one sentence for purpose, one for the critical follow-up action. No unnecessary words, and the key information is front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple delete operation with a single parameter and no output schema, the description covers the core requirements: what it does, how to identify the resource (UUID), and the required next step. A minor improvement would be to explicitly state that the deletion takes effect only after apply, which is already implied.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema already fully describes the lone parameter ('uuid') with a clear description. The description adds no additional semantic value beyond stating 'by UUID', so it meets the baseline for 100% schema coverage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action ('Delete') and the resource ('DNS host override'), with the specific method ('by UUID'). It distinguishes from sibling tools like opnsense_dns_add_override, opnsense_dns_list_overrides, etc.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description includes a crucial follow-up step: 'Run opnsense_dns_apply afterwards to activate.' This guides the agent on the required post-action. However, it lacks explicit when-to-use/not-use context compared to alternatives like updating or adding an override.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

opnsense_dns_diagnosticsB

Dump the current Unbound DNS cache for diagnostic purposes

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

B3.3/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided. The description does not clarify whether dumping is read-only or has side effects, nor does it mention output format or required permissions. For a diagnostic read operation, these details are important.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Single sentence, front-loaded with key action. Appropriately brief, though could benefit from a second sentence for behavioral clarity.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given lack of annotations, output schema, and sibling differentiation, the description is too minimal. It omits output format, safety, and when to use, leaving the agent underinformed.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

No parameters in input schema, so description adds no param info. Schema coverage is 100%, baseline is 4 per rules.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb 'dump' and resource 'current Unbound DNS cache' for diagnostic purposes. It distinguishes from sibling tools like opnsense_dns_cache_search (search) and opnsense_dns_flush_cache (flush).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this tool versus alternatives like opnsense_dns_cache_search or opnsense_dns_stats. Missing context for when a full dump is preferred over search or stats.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

opnsense_dns_flush_cacheB

Flush the Unbound DNS resolver cache

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

B3.4/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description must convey behavioral traits. It only states the action (flush cache), which implies mutation but lacks details on impact, immediacy, or side effects. Minimal disclosure.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Very concise at 6 words, one sentence. Could add minor context (e.g., 'entire cache') but acceptable for a simple operation.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Adequate for a simple no-parameter action, but lacks context on side effects (e.g., performance impact) or when to use relative to siblings. No output schema, so description carries full burden.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters, and schema coverage is 100% (trivially). Per guidelines, 0 params = baseline 4. Description adds no parameter info, which is acceptable.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly specifies the action 'flush' and the resource 'Unbound DNS resolver cache'. It distinguishes from sibling tools like opnsense_dns_flush_zone (different resource) and opnsense_dns_cache_search (different action).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this tool versus alternatives like opnsense_dns_flush_zone or opnsense_dns_cache_search. No mention of when not to use or prerequisites.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

opnsense_dns_flush_zoneA

Flush all cached DNS entries for a specific domain/zone. Use this to clear stale SERVFAIL or outdated records for a domain. Restarts Unbound to ensure complete cache clearing.

ParametersJSON Schema
NameRequiredDescriptionDefault
domainYesDomain/zone to flush (e.g. 'example.com')

TDQS

A4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description mentions 'Restarts Unbound to ensure complete cache clearing,' disclosing a side effect. However, it lacks details on potential service disruption, required privileges, or error conditions. Given no annotations, it does the minimum but could be more thorough.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences with no wasted words. It front-loads the action and then provides usage context and side effects. Every sentence serves a purpose.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple tool with no annotations and no output schema, the description covers purpose, usage, and a key side effect. It does not address prerequisites or failure modes, but overall it is sufficient for an agent to decide and invoke correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, and the parameter description in the schema is already clear. The description adds 'for a specific domain/zone,' which reinforces the parameter meaning but does not provide additional semantic depth beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states 'Flush all cached DNS entries for a specific domain/zone' with a specific verb (flush) and resource (domain-zone DNS cache). It distinguishes from the sibling 'opnsense_dns_flush_cache' by targeting a single domain, not the entire cache.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides a clear use case: 'Use this to clear stale SERVFAIL or outdated records for a domain.' However, it does not explicitly compare with 'opnsense_dns_flush_cache' or state when not to use it, leaving the distinction implicit.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

opnsense_dns_infraA

Dump the Unbound infrastructure cache showing upstream server RTT, EDNS support, and lame delegation status. Useful for diagnosing upstream DNS connectivity issues.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, but the description makes it clear this is a read-only dump operation with no destructive side effects. It does not mention authentication or rate limits, but for a simple diagnostic tool, this is adequate.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences, front-loading the action and then adding context. No unnecessary words. Every sentence earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a parameterless tool with no output schema, the description covers purpose and use case adequately. It could hint at the return format or raw data nature, but the information given is sufficient for an AI agent to understand when to invoke it.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has no parameters, and the input schema has 100% coverage. The description does not need to add parameter information. A baseline of 4 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it dumps the Unbound infrastructure cache, specifying the exact data (RTT, EDNS support, lame delegation status). This is a specific verb+resource, distinguishing it from siblings like opnsense_dns_cache_search which searches cache entries.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly says 'Useful for diagnosing upstream DNS connectivity issues,' providing a clear use case. However, it lacks explicit exclusions or alternatives, though the context of siblings implies when to use this tool vs. others.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

opnsense_dns_list_blocklistA

List all domain overrides (used for domain blocking) in Unbound

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A3.7/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided. The description implies a read operation ('List') but does not explicitly state it is non-destructive or safe. It does not disclose any behavioral traits beyond the basic action.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Single sentence with no extraneous words. The purpose is front-loaded and clear.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no parameters or output schema, the description is minimal. It does not explain what information is returned (e.g., names only or full details). Adequate for a simple list tool but could be more informative.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

No parameters exist, so schema coverage is 100%. The description adds no parameter info, but with zero parameters, baseline is 4.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description explicitly states 'List all domain overrides (used for domain blocking)' which clearly specifies the verb (list), resource (domain overrides), and purpose (blocking). It distinguishes from sibling tool opnsense_dns_list_overrides implying a filtered subset.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this tool vs alternatives like opnsense_dns_list_overrides or opnsense_dns_blocklist_get. The description lacks any context about prerequisites or scenarios.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

opnsense_dns_list_forwardsA

List all DNS-over-TLS forwarding servers configured in Unbound

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Description indicates a read-only list operation. With no annotations, it effectively conveys the non-destructive nature. No additional behavioral details are needed for this simple tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Single sentence is concise and front-loaded with the action and resource. No superfluous words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a parameterless list tool with no output schema, the description fully captures the tool's purpose and behavior. No additional context is required.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

No parameters are present, and schema coverage is 100%. Description adds no parameter-specific information, which is acceptable as there are no parameters to describe.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description clearly states 'List all DNS-over-TLS forwarding servers configured in Unbound' with a specific verb and resource, distinguishing it from sibling tools like opnsense_dns_add_forward.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies use for retrieving existing forwards, but does not explicitly state when not to use or mention alternatives. Context is clear enough given the simplicity of the tool.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

opnsense_dns_list_overridesA

List all DNS host overrides (A/AAAA/CNAME records) configured in Unbound

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided; description clearly indicates a read-only listing operation. Does not describe potential limits or pagination, but the simple nature makes it transparent enough.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Single sentence, 11 words, no filler. Front-loaded with action and resource.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a parameterless list tool, description is sufficient. Lacks explicit output schema, but the nature of listing overrides is clear given the context.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

No parameters exist, so schema coverage is 100%. Description adds context about record types (A/AAAA/CNAME) beyond schema. No output schema, but inferred return is a list of overrides.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Clearly specifies the verb 'list', resource 'DNS host overrides', and record types (A/AAAA/CNAME). Distinguishes from sibling tools like opnsense_dns_list_forwards.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No explicit guidance on when to use vs. alternatives. Context implies listing, but does not mention when not to use or compare with other list tools.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

opnsense_dns_statsA

Get Unbound DNS resolver statistics: query counts, cache hits/misses, uptime, and memory usage

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description must convey behavior. It correctly indicates a read operation (Get statistics) but does not explicitly state idempotence or safety (e.g., 'This is a read-only operation safe to call frequently'). The lack of side effects is implied but not confirmed.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single sentence that is front-loaded with the main action and efficiently lists the statistics included. No unnecessary words or repetition.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no parameters and no output schema, the description covers the tool's purpose and the data it returns. Could explicitly note that it is read-only and non-destructive for completeness, but it is adequate.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has zero parameters (empty object), so schema_coverage is 100%. Per rules, baseline is 4. The description does not need to add parameter info since none exist.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb 'Get', the resource 'Unbound DNS resolver statistics', and specifies the data: query counts, cache hits/misses, uptime, and memory usage. This distinguishes it from siblings like opnsense_diag_dns_lookup (a lookup) and opnsense_dns_cache_search (cache search).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No explicit guidance on when to use this tool vs. the many sibling DNS tools (e.g., for queries, forwarding, overrides). The description implies it's for reading resolver stats, but does not exclude cases where diagnostics or other DNS tools would be more appropriate.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

opnsense_dns_unblock_domainA

Unblock a domain by deleting its domain override. Run opnsense_dns_apply afterwards to activate.

ParametersJSON Schema
NameRequiredDescriptionDefault
uuidYesUUID of the domain override to delete

TDQS

A3.8/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided. Description adds that apply is needed but does not disclose irreversibility, prerequisites, or side effects. Basic behavioral context but incomplete.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two concise sentences with no redundancy. Every word adds value. Front-loaded with purpose.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple delete tool with one parameter, description provides essential steps and follow-up. Missing guidance on obtaining uuid but adequate overall.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema covers 100% of parameters. Description adds no extra meaning beyond schema, which already describes uuid as 'UUID of the domain override to delete'.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description clearly states the action (unblock/delete), resource (domain override), and required follow-up (apply). Distinguishes from sibling tools like opnsense_dns_block_domain.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Mentions need to run apply afterwards but provides no explicit when-to-use or alternatives. Implied context is clear but guidance is minimal.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

opnsense_firmware_checkA

Trigger a background firmware repository check to refresh the cached upgrade status. After calling this, wait briefly and then call 'opnsense_firmware_status' to see fresh upgrade info.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4.3/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden. It discloses that the operation triggers a background check, is non-blocking, and requires a wait. While it doesn't detail side effects or error scenarios, for a simple trigger tool, this is sufficient.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences long, front-loads the action, and contains no redundant information. Every sentence adds value.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool has no parameters, no output schema, and no annotations, the description covers all necessary information: what it does, that a wait is needed, and what to call next. It is complete for a simple trigger tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has no parameters, so schema description coverage is 100%. The description does not need to explain parameters, but it also adds no additional parameter context. Baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb 'Trigger' and the resource 'background firmware repository check'. It distinguishes itself from sibling firmware tools by specifying that it refreshes the cached upgrade status, and it suggests following up with 'opnsense_firmware_status'.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly instructs to wait briefly after calling this tool and then call 'opnsense_firmware_status' to see fresh upgrade info. This provides a clear usage sequence, though it does not explicitly mention when not to use it.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

opnsense_firmware_infoA

Get firmware version, architecture, and update status of the OPNsense system

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A3.8/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries full burden for behavioral disclosure. It only states what the tool retrieves (version, architecture, update status) but does not mention that it is read-only, whether it requires any authentication, or if it has any side effects. This is insufficient for a system info tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence of 8 words, front-loading the action and resource. It is concise and contains no unnecessary information, making it efficient for an agent to parse.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a zero-parameter tool with no output schema, the description adequately covers the key pieces of information returned: firmware version, architecture, and update status. It is complete enough for an agent to understand the tool's output, though additional detail on potential return formats could elevate it to a 5.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters, and the schema description coverage is 100%. According to guidelines, a baseline of 4 is appropriate when there are no parameters, as the description does not need to add parameter details beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb 'Get' and specifies the resource as firmware version, architecture, and update status of the OPNsense system. This distinguishes it from sibling tools like opnsense_firmware_status (likely just status) and opnsense_firmware_check (check for updates).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No explicit guidance on when to use this tool versus other firmware tools such as opnsense_firmware_check or opnsense_firmware_upgrade_status. The description implies it is for reading current info, but it does not state when not to use it or provide alternative options.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

opnsense_firmware_installA

Install an OPNsense plugin package by name (e.g. 'os-acme-client'). May require a service restart.

ParametersJSON Schema
NameRequiredDescriptionDefault
packageYesPlugin package name (e.g. 'os-acme-client', 'os-haproxy')

TDQS

A3.8/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries full burden. It discloses that a service restart may be required, which is helpful. However, it does not detail other potential behaviors (e.g., whether the service restarts automatically, permissions needed, or rollback).

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short sentences, front-loaded with the key action and object. Every word is necessary, no fluff. Perfectly concise.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the low complexity (1 parameter, no output schema), the description is mostly complete. It states the purpose, provides an example, and notes a restart caveat. Missing details about return values or post-install state, but acceptable for the tool's simplicity.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema already provides 100% coverage for the single parameter 'package', including an example. The description adds no new meaning beyond restating 'by name'. Baseline 3 is appropriate since schema does the heavy lifting.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action ('Install') and the resource ('OPNsense plugin package by name'), with an example ('os-acme-client'). It immediately distinguishes itself from sibling tools like opnsense_firmware_remove or opnsense_firmware_upgrade.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage (use when you want to install a plugin), but does not explicitly state when to avoid it or when to use an alternative sibling like opnsense_firmware_upgrade instead. No exclusions or context are provided.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

opnsense_firmware_list_pluginsA

List all available and installed OPNsense plugins with their versions and status

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description implies a read-only operation (list), and no annotations are provided. It does not mention side effects, authentication, or rate limits, but for a list tool minimal disclosure is acceptable.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single, front-loaded sentence that efficiently communicates the tool's function with no wasted words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers the basic purpose and output content (versions and status), but without an output schema, more detail on the return structure could be helpful. However, it is adequate for a simple listing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

No parameters exist, and the input schema is empty with 100% coverage. The description adds no parameter info, but none is needed.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool lists all available and installed plugins with versions and status, using a specific verb and resource. It distinguishes from sibling firmware tools like check, info, install, etc.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No explicit guidance on when to use this tool vs alternatives like opnsense_firmware_info or opnsense_firmware_check. The purpose is clear but lacks context for selection.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

opnsense_firmware_rebootA

Reboot the OPNsense system. Causes a network outage on the firewall and any services it provides (DNS, DHCP, VPN). DESTRUCTIVE: requires explicit confirmation.

ParametersJSON Schema
NameRequiredDescriptionDefault
confirmYesMust be true to confirm the reboot

TDQS

A4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries full burden. It discloses the network outage and destructive nature with confirmation requirement. However, it does not mention if the reboot is synchronous or what the response is.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, no wasted words, front-loaded with the action and consequences.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple reboot tool, the description covers purpose, consequences, and required confirmation. It lacks details on return value, but output schema is absent, so that gap is acceptable.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so baseline is 3. The description adds value by linking 'confirm' to the destructive nature, but does not elaborate beyond what the schema already states.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states 'Reboot the OPNsense system' with a specific verb and resource. It distinguishes itself from siblings by being the only reboot tool listed, and mentions consequences like network outage.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies use when a reboot is needed and warns of destructive effects, but lacks explicit guidance on when to use this tool vs alternatives or when not to use it.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

opnsense_firmware_removeA

Remove an installed OPNsense plugin package. DESTRUCTIVE: requires explicit confirmation.

ParametersJSON Schema
NameRequiredDescriptionDefault
packageYesPlugin package name to remove
confirmYesMust be true to confirm the removal

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden for behavioral disclosure. It explicitly labels the tool as DESTRUCTIVE and notes the confirmation requirement, which is sufficient for a simple removal operation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Single sentence followed by a clear warning. Every word serves a purpose, with the destructive nature front-loaded. No wasted text.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple removal tool with two parameters and no output schema, the description covers the essential behavioral traits: what it does, destructiveness, and confirmation. Could optionally mention result format, but not necessary.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the schema already describes both parameters. The description reinforces the 'confirm' requirement but does not add additional semantic context beyond what the schema provides. Baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description clearly states the action (remove), the resource (installed OPNsense plugin package), and includes a prominent destructive warning. This distinguishes it from sibling tools like install or upgrade.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Warns that the action is destructive and requires explicit confirmation, guiding the agent to use this tool only when removal is intended. Does not explicitly list when not to use or alternatives, but the context is clear.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

opnsense_firmware_statusA

Check for available firmware upgrades and their status (running, pending, done). Reads the cached state — call 'opnsense_firmware_check' first if the cache may be stale.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4.7/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Discloses it reads cached state and implies no destructive effects, compensating for missing annotations. Could add more detail on cache freshness or auth requirements.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Single sentence with verb first, no wasted words. Efficient and front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple read-only tool with no parameters, description covers purpose, cache behavior, relationship to sibling, and output scope, making it complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

No parameters exist; description correctly adds no parameter info. According to guidelines, 0 params baseline is 4.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Clearly states verb 'check' and resource 'firmware upgrades and their status'. Differentiates from siblings like opnsense_firmware_check by noting it reads cached state, making purpose specific.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly advises to call opnsense_firmware_check first if cache may be stale, providing clear when-to-use and when-not-to-use guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

opnsense_firmware_upgradeA

Trigger an OPNsense system upgrade based on what 'opnsense_firmware_status' reports (minor packages, or a major-series jump such as 24.7 → 25.1). Long-running: poll progress with 'opnsense_firmware_upgrade_status'. A reboot is typically required afterwards. DESTRUCTIVE: requires explicit confirmation.

ParametersJSON Schema
NameRequiredDescriptionDefault
confirmYesMust be true to confirm the upgrade

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden and discloses key behavioral traits: destructive nature, requirement for explicit confirmation (via confirm parameter), long-running operation, and typical need for reboot. It could mention error handling or cancellation, but covers the major risks.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is extremely concise: two sentences plus a warning. It front-loads the purpose and includes all critical information without unnecessary words. Every sentence adds value.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a destructive, long-running tool with a simple input schema and no output schema, the description explains the trigger, polling mechanism, and aftermath. It lacks explicit mention of the immediate return value, but the reference to polling implies a task identifier is returned. Overall fairly complete for an AI agent.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% with a single 'confirm' parameter. The description reiterates the need for confirmation but adds no new semantic information beyond the schema. Baseline score of 3 is appropriate as the schema already documents the parameter well.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool triggers an OPNsense system upgrade, specifying it is based on firmware status reports and distinguishing between minor and major upgrades. It references sibling tools like opnsense_firmware_status and opnsense_firmware_upgrade_status, differentiating this from other firmware operations.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides clear context on when to use the tool: after checking firmware status, and it tells the agent to poll progress with a sibling tool and expect a reboot. It does not explicitly state when NOT to use it, but the context is sufficient for an AI agent to infer appropriate usage.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

opnsense_firmware_upgrade_statusA

Get the progress/log of a currently running or last completed firmware upgrade (long-running operation status).

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A3.8/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries full responsibility for behavioral disclosure. It reveals that the tool returns data from a currently running or last completed upgrade, and labels it as a 'long-running operation status' tool. However, it does not specify whether the call is blocking, if it requires authentication, or what happens if no upgrade has ever occurred. Some behavioral aspects remain implicit.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence that is concise, front-loaded with the action ('Get'), and contains no unnecessary words. Every part of the sentence adds value: verb, object, scope ('currently running or last completed'), and nature ('long-running operation status').

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with no parameters and no output schema, the description provides essential information about purpose and output (progress/log). It is nearly complete but could slightly benefit from mentioning that a firmware upgrade must have been initiated (e.g., via opnsense_firmware_upgrade) for there to be status to retrieve. Nonetheless, it is adequate for the tool's simplicity.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has zero parameters and schema description coverage is 100%, so the description does not need to add parameter details. The baseline of 3 is appropriate because the description provides no additional semantic value beyond the schema, which is already complete given the absence of parameters.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb 'Get' and the resource 'progress/log of a currently running or last completed firmware upgrade'. It distinguishes itself from siblings like opnsense_firmware_upgrade (which triggers the upgrade) and opnsense_firmware_status (which may provide general firmware status) by specifying the exact function of retrieving upgrade progress/log.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage after triggering a firmware upgrade (via opnsense_firmware_upgrade) by mentioning 'currently running or last completed' and 'long-running operation status', but it does not explicitly state when to use this tool versus alternatives like opnsense_firmware_status, nor does it provide conditions for use or exclusions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

opnsense_fw_add_ruleA

Add a new firewall filter rule. Run opnsense_fw_apply afterwards to activate.

ParametersJSON Schema
NameRequiredDescriptionDefault
actionYesRule action
directionYesTraffic direction
interfaceNoInterface name (e.g. 'lan', 'wan')
protocolNoProtocol
source_netNoSource network (CIDR, alias, or 'any')
destination_netNoDestination network (CIDR, alias, or 'any')
destination_portNoDestination port or range (e.g. '443', '80-443')
descriptionNoRule description

TDQS

A3.9/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Discloses activation delay via fw_apply, but absent annotation burden means missing authorization, idempotency, side effects on existing rules.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two efficient sentences: first states purpose, second gives critical activation instruction. No fluff.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Adequate for a simple tool but missing context like rule ordering, duplicate handling, validation, and required permissions.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema covers 100% of parameters; description adds no extra semantics beyond what schema already provides.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description clearly states action (Add) and resource (firewall filter rule), distinguishing it from sibling tools like delete, list, apply.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides explicit post-action step (run fw_apply), but lacks guidance on when to use this vs update_rule or ordering considerations.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

opnsense_fw_applyA

Apply pending firewall configuration changes

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A3.5/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are present, and the description fails to disclose behavioral traits such as whether the apply causes service disruption, returns success/failure, or requires authentication. The agent is left guessing about side effects.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, front-loaded sentence that efficiently conveys the tool's purpose without unnecessary words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

As a parameterless apply action with no output schema, the description provides the bare minimum. It lacks information on success indicators, error handling, or confirmation steps, making it only marginally complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has zero parameters, so the description adds no parameter semantics beyond what the schema already conveys. With no parameters, the baseline is high, and the description is sufficient.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb 'apply' and resource 'pending firewall configuration changes', distinguishing it from other apply tools like opnsense_dns_apply or opnsense_route_apply.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No usage guidance is provided. The description does not indicate when to use this tool versus alternatives, nor does it mention prerequisites or that it should be called after making firewall rule changes.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

opnsense_fw_delete_ruleA

Delete a firewall filter rule by UUID. Run opnsense_fw_apply afterwards to activate.

ParametersJSON Schema
NameRequiredDescriptionDefault
uuidYesUUID of the rule to delete

TDQS

A4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description discloses the need to apply changes, which is a behavioral trait. However, without annotations, it could be more explicit about irreversibility or that it removes the rule permanently. The word 'delete' implies destruction, but additional context would improve transparency.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short sentences, front-loaded with the main action. No filler words; every sentence serves a purpose.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple tool with one parameter and no output schema, the description covers the action and the necessary post-step. It could mention that the UUID must refer to an existing rule, but that is implied.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so baseline is 3. The description does not add meaning beyond the schema's 'UUID of the rule to delete'. No extra context is provided for the parameter.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action (Delete), the resource (firewall filter rule), and the identifier (by UUID). It is specific and distinguishes from sibling tools like opnsense_fw_add_rule or opnsense_fw_toggle_rule.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides explicit guidance that after deletion, opnsense_fw_apply must be run to activate the change. This helps the agent understand the workflow, though it does not explicitly state when not to use this tool (e.g., if undo is needed).

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

opnsense_fw_drift_checkA

Audit firewall filter rules for description hygiene. Returns rules whose description does not match the given regex (default: '^#\d+:' — issue-reference prefix) and rules with empty descriptions. Read-only.

ParametersJSON Schema
NameRequiredDescriptionDefault
description_prefix_regexNoRegex that rule descriptions MUST match (default: '^#\d+:' — requires a GitHub issue reference like '#361: ...')
categoryNoOptional category name to restrict the audit to rules in that category (exact match)

TDQS

A4.1/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries full burden. It explicitly says 'Read-only' and explains the matching logic and default regex, providing essential behavioral context beyond the input schema.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two concise sentences that front-load purpose and detail return conditions without fluff. Every sentence earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

No output schema exists, so description should specify return format more clearly. It says 'returns rules' but does not indicate if it returns rule IDs, names, categories, etc. Slightly incomplete for full contextual completeness.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so description adds limited value. It explains the default regex pattern for description_prefix_regex, but category parameter is not elaborated beyond schema. This is adequate but not outstanding.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description clearly states the verb 'audit' and resource 'firewall filter rules' for description hygiene. It distinguishes from sibling fw tools like opnsense_fw_list_rules by focusing on checking description compliance with a regex.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Describes what the tool returns (non-matching and empty descriptions) and is read-only, giving clear context. However, it does not explicitly exclude scenarios or mention alternatives when other fw tools might be more appropriate.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

opnsense_fw_list_aliasesA

List all firewall aliases (host groups, networks, ports, URLs)

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided, so description carries full burden. It indicates a non-destructive read operation but provides no additional behavioral details such as authentication or rate limits.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Single sentence, 12 words, perfectly concise and front-loaded with the purpose. No wasted words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Adequate for a simple list tool with no parameters and no output schema. Includes alias types but could mention return format briefly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Input schema has no parameters, and schema description coverage is 100%. The description adds value by specifying alias types, going beyond the empty schema. Baseline for 0 params is 4.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Clearly states the verb 'List' and resource 'firewall aliases' with examples of types (host groups, networks, ports, URLs), distinguishing it from sibling tools like opnsense_fw_manage_alias and opnsense_fw_list_rules.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No explicit when-to-use or alternative guidance. Only implied by the description that it lists aliases, but lacks context for when to use instead of other list tools.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

opnsense_fw_list_rulesA

List all firewall filter rules

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A3.7/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations exist, and the description does not disclose behavioral traits like read-only or side effects. The verb 'list' weakly implies non-destructive behavior, but more explicit context is needed.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Single concise sentence with no wasted words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Adequate for a simple list-all operation, but since there is no output schema, missing information about return format or any filtering capabilities.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Zero parameters with 100% schema coverage; baseline for no parameters is 4. Description adds no additional meaning beyond schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description uses specific verb 'list' and resource 'firewall filter rules', clearly distinguishing it from sibling tools like add, delete, or update rules.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No explicit when-to-use or alternatives are provided. Usage is implied as a read-only operation for viewing all rules, but lacks comparison with siblings.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

opnsense_fw_manage_aliasA

Create, update, or delete a firewall alias. Run opnsense_fw_apply afterwards to activate.

ParametersJSON Schema
NameRequiredDescriptionDefault
actionYesAction to perform
uuidNoUUID of alias (required for update/delete)
nameNoAlias name (required for create)
typeNoAlias type: host, network, port, url, etc. (required for create)
contentNoAlias content — newline-separated values (required for create)
descriptionNoAlias description

TDQS

A3.6/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description must carry the burden of behavioral disclosure. It reveals that the tool modifies aliases and requires a separate apply step, but lacks details on permissions, side effects, or whether changes are reversible. For a modification tool with zero annotation coverage, this is a significant gap.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is extremely concise—two sentences with no filler. It front-loads the action verbs and includes the critical activation hint. Every word earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool has no output schema and the description does not mention return values or error handling, it lacks completeness for a CRUD tool with 6 parameters. The agent would benefit from knowing what the tool returns (e.g., UUID of created alias) and any validation behavior.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

All six parameters have descriptions in the schema (100% coverage), so the description adds no additional meaning beyond the schema. Baseline 3 is appropriate; it does not explain parameter relationships or conditional requirements across actions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: 'Create, update, or delete a firewall alias.' This verb+resource combination is specific and distinguishes it from sibling tools like opnsense_fw_list_aliases (list) and opnsense_fw_apply (apply).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly instructs to 'Run opnsense_fw_apply afterwards to activate,' which guides the agent on the required post-action step. Although it does not explicitly contrast with list or rule management tools, the context of 'firewall alias' and the sibling tool names imply when to use this tool.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

opnsense_fw_reorder_rulesA

Change the sequence (ordering) of a firewall filter rule by UUID. Rules with lower sequence values are evaluated first. Use this to enforce whitelist-before-deny ordering. Run opnsense_fw_apply afterwards to activate.

ParametersJSON Schema
NameRequiredDescriptionDefault
uuidYesUUID of the rule to reorder
sequenceYesNew sequence value (positive integer). Lower values are evaluated first.

TDQS

A4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided, so description must convey behavior. It explains that sequence determines evaluation order and that apply is needed, but doesn't cover potential side effects, constraints on sequence values, or other behavioral traits.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short sentences, front-loaded with action and purpose. Every sentence is necessary and no filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple tool with only two parameters and no output schema, the description covers the core functionality and required follow-up. Minor gaps in error handling or sequence conflict info, but still complete for most use cases.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Input schema has 100% coverage with clear parameter descriptions. The description adds context about sequence meaning (lower=first), but no further semantic value beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it changes the sequence of firewall filter rules by UUID, explaining that lower values are evaluated first. This distinguishes it from sibling tools like add, delete, update, or toggle rules.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides explicit usage scenario: 'enforce whitelist-before-deny ordering' and instructs to run opnsense_fw_apply afterwards. Does not explicitly mention when not to use, but gives clear context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

opnsense_fw_toggle_ruleA

Enable or disable a firewall rule by UUID. Run opnsense_fw_apply afterwards to activate.

ParametersJSON Schema
NameRequiredDescriptionDefault
uuidYesUUID of the rule to toggle
enabledYes1 to enable, 0 to disable

TDQS

A3.8/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided. Description only mentions the action and follow-up step. Lacks details on side effects, required permissions, error behavior (e.g., rule not found), or whether the change is reversible. Minimal disclosure for a mutation tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, no fluff. First sentence states the action, second provides essential follow-up instruction. Highly efficient.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no annotations and no output schema, the description covers the core purpose and necessary follow-up step. It is adequate for a simple toggle tool. Could be improved by noting that it only changes enabled status (and not other rule properties), but that is implicit from the tool name and sibling tools.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Input schema covers both parameters (uuid, enabled) with clear descriptions. The tool description doesn't add meaningful detail beyond what the schema already provides. Schema coverage is 100%, so baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Clearly states 'Enable or disable a firewall rule by UUID' — specific verb and resource. Distinguished from siblings like add_rule, delete_rule, update_rule because it focuses on toggling enabled status.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly instructs to run opnsense_fw_apply afterwards, guiding the agent on the next step. However, it doesn't explicitly state when not to use this tool (e.g., for other changes, use update_rule), but the sibling context makes it clear enough.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

opnsense_fw_update_ruleA

Update an existing firewall filter rule by UUID. Run opnsense_fw_apply afterwards to activate.

ParametersJSON Schema
NameRequiredDescriptionDefault
uuidYesUUID of the rule to update
actionYesRule action
directionYesTraffic direction
interfaceNoInterface name
protocolNoProtocol
source_netNoSource network
destination_netNoDestination network
destination_portNoDestination port or range
descriptionNoRule description

TDQS

A3.6/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries full burden. It only states the update action and need for apply. Missing behaviors: whether update is partial or full, error handling, auth requirements.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short sentences, front-loaded with purpose, zero waste. Every word earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Tool has 9 parameters (many optional) and no output schema. Description does not explain return values, error conditions, or behavior with partial updates, leaving significant gaps.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% with descriptions for all 9 parameters. The description adds no extra meaning beyond the schema, so baseline of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb 'Update', the resource 'existing firewall filter rule', and the method 'by UUID'. It distinguishes from siblings like opnsense_fw_add_rule and opnsense_fw_delete_rule.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description includes critical guidance: 'Run opnsense_fw_apply afterwards to activate.' It provides context but does not explicitly state when not to use this tool or suggest alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

opnsense_if_assignA

Assign an existing VLAN or NIC device to a free optN slot via SSH. Requires OPNSENSE_SSH_ENABLED=true and the opnsense-helpers/if_assign.php script installed on the target host. Fills the gap where the OPNsense REST API has no 'Interfaces → Assignments' endpoint.

ParametersJSON Schema
NameRequiredDescriptionDefault
slotYesTarget slot (e.g. 'opt1', 'opt2'). Must be free.
ifYesDevice to assign (e.g. 'vlan10' for a VLAN or 'igb0' for a real NIC)
descrNoOptional friendly description (max 120 chars)

TDQS

A4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description discloses that the tool performs a write operation via SSH and requires specific setup. However, it does not describe side effects, error conditions, or return format, which are important for a network configuration change tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three sentences covering action, prerequisites, and justification. No redundant information. All sentences earn their place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool has 3 simple parameters and no output schema, the description provides sufficient context: what it does, prerequisites, and why it exists. It does not detail return values or error handling, but for a configuration assignment tool this is acceptable.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the schema already describes each parameter. The tool description adds context (slot must be free, device can be vlan/nic) but does not significantly extend beyond the schema descriptions. Baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action ('Assign an existing VLAN or NIC device'), the target ('a free optN slot'), and the method ('via SSH'). It also distinguishes itself by noting it fills a REST API gap, differentiating from sibling tools like opnsense_if_list.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly lists prerequisites (OPNSENSE_SSH_ENABLED=true and the helper script) and the use case (filling a REST API gap). It does not provide explicit when-not-to-use or alternative tools, but the context is clear enough for an agent.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

opnsense_if_configureA

Configure IPv4/IPv6 on an already-assigned optN slot via SSH. Supports static, dhcp, dhcp6, track6, and 'none'. Requires OPNSENSE_SSH_ENABLED=true and the opnsense-helpers/if_configure.php script installed on the target host.

ParametersJSON Schema
NameRequiredDescriptionDefault
slotYesTarget slot (must already be assigned, e.g. 'opt1')
ipv4NoIPv4 address (e.g. '10.10.10.1'), or 'none' / 'dhcp'. Omit to leave IPv4 unchanged.
subnetNoIPv4 CIDR prefix length (0..32). Required when ipv4 is a literal address.
ipv6NoIPv6 address, or 'none' / 'dhcp6' / 'track6'. Omit to leave IPv6 unchanged.
subnetv6NoIPv6 CIDR prefix length (0..128). Required when ipv6 is a literal address.
track6_interfaceNoParent interface for track6 (e.g. 'wan'). Required when ipv6=track6.
track6_prefix_idNoNumeric prefix ID for track6 (optional)
descrNoOptional friendly description (max 120 chars)
no_filter_reloadNoSkip filter_configure() after applying (default false). Useful when batching multiple configures.

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description discloses that the tool works on already-assigned slots, supports various IP modes, and includes a no_filter_reload parameter to control behavior. It lacks details on error cases or side effects, but given no annotations, this is reasonable.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences: first covers purpose and supported modes, second lists prerequisites. No redundant information, front-loaded with the key action.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool has 9 parameters and no output schema. The description explains core purpose, supported modes, prerequisites, and one behavioral parameter (no_filter_reload). Missing details on return values or error handling, but sufficient for typical use.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so baseline is 3. The description adds value by explaining supported IP modes (static, dhcp, etc.) and how parameters like subnet are conditionally required, which goes beyond the schema descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description explicitly states 'Configure IPv4/IPv6 on an already-assigned optN slot via SSH' and lists supported modes. This clearly distinguishes it from sibling tools like opnsense_if_assign (for assignment) and opnsense_if_get (read-only).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description mentions prerequisites (OPNSENSE_SSH_ENABLED=true and the required script), which guides when the tool can be used. However, it does not explicitly state when not to use it vs alternatives, though the context is implied.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

opnsense_if_getA

Get detailed configuration for a specific network interface (IP addresses, status, MTU, etc.)

ParametersJSON Schema
NameRequiredDescriptionDefault
interface_nameYesInterface name (e.g. 'lan', 'wan', 'opt1')

TDQS

A4.2/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It indicates a read operation via 'Get', but does not explicitly state it is read-only, has no side effects, or disclose any behavioral traits such as rate limits or required permissions.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, focused sentence that efficiently conveys the tool's purpose without redundant information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's simplicity (one parameter) and the absence of an output schema, the description provides enough context to understand the return fields. However, it does not specify the exact response structure, which could be helpful for an agent parsing the output.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema already describes the single parameter with examples, and the description adds context that it returns configuration details including IP addresses, status, MTU, etc. This supplements the schema well, though the description does not detail each parameter separately.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool retrieves detailed configuration for a specific network interface, listing example fields like IP addresses, status, and MTU. This distinguishes it from sibling tools like opnsense_if_list (which likely returns a summary list) and opnsense_if_stats (which may return statistics).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies this tool is used when detailed configuration for a single interface is needed, as opposed to listing all interfaces or retrieving stats. However, it does not explicitly state when not to use it or provide alternative tool names.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

opnsense_if_listA

List all network interface names and their device mappings

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4.2/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided, so description carries full burden. It discloses the listing function but lacks details on read-only nature, auth requirements, or result format. Adequate but not rich.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Single sentence, direct and front-loaded, with no extraneous text. Perfectly concise.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple list tool with no output schema, description gives the gist (interface names and device mappings). Could hint at output structure but sufficient for common use.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

No parameters exist and schema coverage is 100%, so description adds no param info. Baseline 4 is appropriate given zero parameters.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description clearly states verb 'List' and resource 'all network interface names' with specific detail 'device mappings', distinguishing from siblings like opnsense_if_get (single interface) and opnsense_if_stats.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Implies use for listing all interfaces, but does not explicitly contrast with sibling tools opnsense_if_get, opnsense_if_stats, or opnsense_if_configure. Context is clear enough for basic selection.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

opnsense_if_statsA

Get traffic statistics for all interfaces (bytes, packets, errors, collisions)

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A3.8/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided, so the description must bear the full transparency burden. It mentions return metrics but does not disclose whether the operation is read-only, safe, or if it requires special permissions. The lack of annotations and limited behavioral disclosure reduces transparency.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence of 12 words, extremely concise. It front-loads the key action and result metrics with no redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a zero-parameter tool, the description adequately covers the purpose and output. It lists the metrics returned, which is sufficient for an agent to understand the tool's function. However, it could mention the return format (e.g., list of interfaces) for completeness.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has no parameters (100% coverage). The description adds value by specifying the returned statistics (bytes, packets, errors, collisions), which would not be clear from the schema alone. This compensates for the lack of parameter details.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: 'Get traffic statistics for all interfaces' and specifies the metrics (bytes, packets, errors, collisions). It distinguishes from sibling tools like opnsense_if_list (which likely lists interfaces) and opnsense_if_get (which gets interface config).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies when to use this tool (to get stats for all interfaces) but does not explicitly contrast with alternatives or state when not to use. It lacks prerequisites or exclusions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

opnsense_kea_applyA

Apply pending Kea DHCP configuration changes (reconfigure service). Run after subnet or reservation changes.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4.2/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description mentions 'reconfigure service', indicating a reload of the Kea service. However, it does not detail potential side effects (e.g., brief DHCP interruption) or note that the action is safe. With no annotations, more disclosure would improve transparency.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is extremely concise: one sentence stating the action and a brief usage hint. No redundant words, easy to parse.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's simplicity (no params, no output schema), the description covers the essential: what it does and when to use it. It could briefly mention the effect after applying (e.g., changes become active), but it is largely complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters and 100% schema coverage, so the description does not need to add parameter info. The baseline for zero parameters is 4, and the description adds no unnecessary parameter details.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb 'Apply' and the resource 'pending Kea DHCP configuration changes', and provides context 'reconfigure service'. It distinguishes from sibling apply tools (e.g., opnsense_fw_apply) by specifying Kea DHCP.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly advises 'Run after subnet or reservation changes', giving clear usage context. It does not explicitly list when not to use, but the guidance is sufficient given the tool's specific purpose.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

opnsense_kea_subnet_createA

Create a new Kea DHCPv4 subnet. Run opnsense_kea_apply afterwards to activate.

ParametersJSON Schema
NameRequiredDescriptionDefault
subnetYesSubnet in CIDR notation (e.g., 10.10.0.0/24)
poolsNoPool range (e.g., 10.10.0.100-10.10.0.199)
descriptionNoOptional description
option_data_autocollectNoAuto collect option data (0 or 1, default: 1)
routerNoDefault gateway IP
dns_serversNoComma-separated DNS server IPs
domain_nameNoDomain name for clients
domain_searchNoDomain search list (comma-separated)
ntp_serversNoComma-separated NTP server IPs

TDQS

A3.9/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided, so description carries the full burden. It mentions the need to apply afterwards, implying a deferred activation, but lacks details on side effects, error handling, or prerequisites.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two efficient sentences with no fluff: one for purpose, one for usage hint. Every word earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given 9 parameters (many optional) and no output schema, the description is minimal. It explains the necessary apply step but does not address return values, validation, or how pools interact.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% (all 9 parameters have descriptions). The tool description adds no extra meaning beyond what the schema already provides.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action (create) and the resource (Kea DHCPv4 subnet). It distinguishes from sibling tools like delete/list/get/update and links to the apply step.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides a clear post-action step (run opnsense_kea_apply to activate), giving context on usage. However, it does not explicitly compare to alternatives or state when not to use.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

opnsense_kea_subnet_deleteA

Delete a Kea DHCPv4 subnet by UUID. Run opnsense_kea_apply afterwards to activate.

ParametersJSON Schema
NameRequiredDescriptionDefault
uuidYesSubnet UUID to delete

TDQS

A3.8/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations exist, so the description carries the full burden. It only states 'Delete' and the apply step, but does not disclose irreversibility, potential loss of associated data, or other behavioral traits. Minimal disclosure.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Extremely concise: two sentences with no filler. Every word serves a purpose.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple delete operation with one parameter and no output schema, the description covers the action and required follow-up. However, it lacks prerequisites or side effects. Slightly incomplete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema already fully describes the uuid parameter (100% coverage). The description adds 'by UUID' but no additional meaning beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it deletes a Kea DHCPv4 subnet by UUID, distinguishing it from sibling tools like create, update, get, and list.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly mentions the need to run opnsense_kea_apply afterwards to activate the change, providing useful post-deletion guidance. It does not specify when not to use or alternatives, but the purpose is clear enough.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

opnsense_kea_subnet_getA

Get detailed configuration of a specific Kea DHCPv4 subnet by UUID.

ParametersJSON Schema
NameRequiredDescriptionDefault
uuidYesSubnet UUID

TDQS

A3.6/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries full burden for behavioral disclosure. It states it is a read operation ('Get detailed configuration'), but offers no details on error handling, permissions required, or what happens if the UUID does not exist. The description lacks transparency beyond its basic function.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence with 11 words, directly stating the action and method. It is front-loaded and every word contributes to the meaning. No redundancy or filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple get operation with one parameter and no output schema, the description provides essential information: what the tool does and how to identify the target. It does not specify the return format or error handling, but given the simplicity, it is reasonably complete. The context signals indicate no nested objects or enums, so additional detail is less critical.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% (the 'uuid' parameter is described as 'Subnet UUID'). The description adds minimal value by restating that it is identified 'by UUID'. Since the schema already explains the parameter, the description does not significantly enhance understanding.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action ('Get detailed configuration'), the target resource ('Kea DHCPv4 subnet'), and the identifier method ('by UUID'). It effectively distinguishes from sibling tools like opnsense_kea_subnet_list (which lists multiple subnets) and opnsense_kea_subnet_create (which creates). The verb-resource combination is specific and unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage when you have a UUID and need detailed config, but it does not explicitly state when to use this tool versus alternatives like opnsense_kea_subnet_list or opnsense_kea_subnet_get for other versions. No exclusions or prerequisites are mentioned, so guidance is only implied by context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

opnsense_kea_subnet_listA

List all Kea DHCPv4 subnets with their pools, options, and reservation counts.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Without annotations, the description properly indicates the tool lists all subnets with specific details. It does not mention authentication or pagination, but for a simple list, the behavioral expectations are clear.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Single sentence with 12 words, front-loaded, no redundancy. Every word adds value.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no parameters or output schema, the description is nearly complete. It lacks mention of pagination or sorting, but for a simple list-all operation, it suffices.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

No parameters exist; schema coverage is 100% (empty schema). The description implies a full list with no filters, which is appropriate. Baseline 4 for no-parameter tools.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb 'List' and the resource 'Kea DHCPv4 subnets', and specifies included details (pools, options, reservation counts). It differentiates from sibling tools like subnet_get, subnet_create, etc.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this tool vs alternatives (e.g., when to use subnet_get for a single subnet). The description does not mention exclusions or prerequisites.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

opnsense_kea_subnet_updateA

Update an existing Kea DHCPv4 subnet. Run opnsense_kea_apply afterwards to activate.

ParametersJSON Schema
NameRequiredDescriptionDefault
uuidYesSubnet UUID
subnetYesSubnet in CIDR notation
poolsNoPool range (e.g., 10.10.0.100-10.10.0.199)
descriptionNoOptional description
option_data_autocollectNoAuto collect option data (0 or 1)
routerNoDefault gateway IP
dns_serversNoComma-separated DNS server IPs
domain_nameNoDomain name for clients
domain_searchNoDomain search list (comma-separated)
ntp_serversNoComma-separated NTP server IPs

TDQS

A3.6/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description must disclose behavioral traits. It only says 'update' and 'run apply' without detailing whether the update is incremental or full, validation behavior, permissions needed, or effect on active clients. This is insufficient for a mutation tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, zero waste. The action and critical follow-up instruction are front-loaded, making it easy to scan.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Despite having 10 parameters (2 required) and no output schema or annotations, the description only covers the basic update+apply workflow. It lacks explanation of return values, error conditions, or what happens on failure. This is incomplete for a tool of this complexity.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the input schema already documents all parameters. The description adds no additional parameter-level meaning, earning the baseline score of 3.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action (update), the resource (existing Kea DHCPv4 subnet), and the required follow-up step. It distinguishes itself from sibling tools like create, delete, get, and list.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly instructs to run opnsense_kea_apply afterwards to activate changes. This provides clear context for when to use the tool, though it does not mention exclusions or alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

opnsense_nat_applyB

Apply pending NAT configuration changes. Required after add/update/delete/toggle for changes to take effect. DESTRUCTIVE.

ParametersJSON Schema
NameRequiredDescriptionDefault
confirmYes

TDQS

B3.2/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description must fully disclose behavioral traits. It only includes a vague 'DESTRUCTIVE' warning, but does not explain what is destroyed (e.g., existing NAT state, network connectivity), prerequisites (e.g., need for confirm=true), or any rate limits. The confirm parameter is present but not described. This leaves significant gaps given the destructive nature.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is very concise, with two clear sentences and one keyword ('DESTRUCTIVE'). It is front-loaded and gets to the point quickly. However, structure could be improved by formatting or separating the warning for readability.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description lacks important context for a destructive mutation tool: no mention of the confirm parameter, no explanation of what 'applying' means (e.g., reloading firewall, temporary disruption), and no output schema. While the tool is simple, the missing guidance on safe usage (e.g., confirm must be true) makes it incomplete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters1/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has a single required parameter 'confirm' with enum [true], but the description does not mention it or explain its meaning (e.g., confirmation flag, irreversible action). With 0% schema description coverage, the description fails to add any value beyond the schema's basic type constraints.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool applies pending NAT configuration changes, with a specific verb ('Apply') and resource ('NAT configuration changes'). It also distinguishes itself from sibling tools by noting it is required after add/update/delete/toggle operations, which sets it apart from other NAT-related tools like opnsense_nat_source_add.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly states it is required after add/update/delete/toggle for changes to take effect, indicating when to use it. However, it does not mention when not to use it or provide explicit alternatives, though the unique purpose among siblings implies no direct substitutes.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

opnsense_nat_source_addA

Add a new Source NAT (outbound) rule. After adding, call opnsense_nat_apply to activate. DESTRUCTIVE: requires explicit confirmation.

ParametersJSON Schema
NameRequiredDescriptionDefault
enabledNoRule enabled (default: true)
interfaceYesInterface name (e.g. 'wan', 'lan', 'opt1')
ipprotocolNoIP version
protocolNoProtocol: any/TCP/UDP/TCP/UDP/ICMP/...
source_netNoSource network (any/CIDR/alias). Default: any
source_notNoInvert source match
source_portNoSource port/range
destination_netNoDestination network. Default: any
destination_notNoInvert destination match
destination_portNoDestination port/range
targetNoTranslation target: 'wanip' (default), specific IP, or alias
target_portNoTranslation target port
staticnatportNoUse static source port
nonatNoIf true, exclude this traffic from NAT (no-NAT rule)
logNoLog packets matching this rule
sequenceNoRule order (default: 100)
taggedNoMatch a packet tag set by another rule
descriptionNoHuman-readable description
confirmYesMust be true to confirm

TDQS

A3.9/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden. It discloses that the tool is destructive and requires explicit confirmation, which is good. However, it does not elaborate on what 'destructive' entails (e.g., overwriting existing config, immediate firewall impact), nor does it describe the behavior if confirm is false or the result after calling apply.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise: two sentences that front-load the purpose and include a critical post-action instruction and a warning. No unnecessary words or redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool has 19 parameters and no output schema, the description is adequate for a basic add operation. It covers the core purpose and the necessary activation step. However, it lacks examples, expected return values, or guidance on parameter combinations, which would be helpful given the high parameter count.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 100% description coverage for all 19 parameters, so the baseline is 3. The description adds no extra parameter-specific semantics beyond what the schema already provides. It mentions the post-apply requirement but does not clarify default values or relationships between parameters.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action: 'Add a new Source NAT (outbound) rule.' It uses a specific verb ('Add') and resource ('Source NAT rule'), and distinguishes from sibling tools like opnsense_nat_source_update and opnsense_nat_apply by mentioning the need to call apply afterwards.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides clear guidance: when adding a new rule, and that a follow-up call to opnsense_nat_apply is required. It also warns of destructiveness and the need for explicit confirmation. However, it does not explicitly state when to use this tool versus update or other alternatives, but the context of adding is clear.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

opnsense_nat_source_deleteA

Delete a Source NAT rule. DESTRUCTIVE: requires explicit confirmation.

ParametersJSON Schema
NameRequiredDescriptionDefault
uuidYesRule UUID
confirmYes

TDQS

A3.7/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It discloses destructiveness and the need for confirmation. However, it fails to mention that changes may require a subsequent apply (as sibling opnsense_nat_apply exists), which is important behavioral context.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence plus a warning, efficiently conveying the action and key requirement. No unnecessary words, front-loaded with the verb.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool is simple, but the description omits whether deletion takes effect immediately or requires a separate apply step (sibling opnsense_nat_apply suggests staged changes). Also lacks information on error handling or response behavior. Incomplete for a destructive tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 50% (only uuid has a description 'Rule UUID'). The description adds 'requires explicit confirmation' for the confirm parameter, but does not elaborate on uuid. Given the low coverage, the description should compensate more, but it adds minimal value beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states 'Delete a Source NAT rule,' which is a specific verb and resource. It distinguishes itself from sibling tools like opnsense_nat_source_add and opnsense_nat_source_get.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly mentions 'requires explicit confirmation,' guiding the agent to use the confirm parameter. However, it does not provide context about when to use this delete tool versus other alternatives like toggling, but for a delete tool this is adequate.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

opnsense_nat_source_getA

Get a single Source NAT rule by UUID with full configuration. Read-only.

ParametersJSON Schema
NameRequiredDescriptionDefault
uuidYesSource NAT rule UUID

TDQS

A4.1/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided, so description bears full burden. It declares 'Read-only', which is a key behavioral trait. However, it does not disclose potential side effects, auth requirements, or rate limits. For read-only, this is acceptable but not exemplary.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Single sentence, concise, front-loaded with action. No unnecessary words. Perfect for a simple tool.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 1-parameter, no-output-schema tool, the description is complete: it tells what it does, how to identify the rule, and that it's read-only. No gaps.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, and the only parameter 'uuid' is described. The description adds 'by UUID' confirming usage but no extra constraints or formatting details. Baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it retrieves a single Source NAT rule by UUID, distinguishing it from list, add, delete siblings. The verb 'Get' and resource 'Source NAT rule' are specific, and 'by UUID' adds precision.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies when to use (need a specific rule's full config), but does not explicitly list alternatives or when not to use. For a simple retrieval tool, this is adequate.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

opnsense_nat_source_listA

List all Source NAT (outbound) rules. Read-only. Returns rule UUID, sequence, interface, source/destination, target, enabled state.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries full burden. It declares 'Read-only' and lists return fields, but lacks details on pagination, rate limits, error conditions, or behavior when no rules exist. Basic transparency is provided but not comprehensive.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two well-structured sentences: the first states the action and resource, the second lists return fields. No wasted words, front-loaded, and efficient.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple list tool with no parameters and no output schema, the description adequately covers purpose, return fields, and read-only nature. Minor missing context like sorting or limits would improve completeness, but it is sufficient for typical use.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has zero parameters, so the description need not add parameter details. It adds value by stating 'List all', indicating no filtering is possible, which clarifies the tool's scope beyond the empty schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb 'list' and the resource 'Source NAT (outbound) rules', and enumerates the return fields (UUID, sequence, interface, source/destination, target, enabled state). It distinguishes from sibling tools like opnsense_nat_source_add/delete/get/toggle/update by being a read-only list operation.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description mentions 'List all' implying it is for a full listing, and 'Read-only' indicating no side effects. However, it does not explicitly guide when to use this tool over alternatives like opnsense_nat_source_get or provide context for filtering or prerequisites.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

opnsense_nat_source_toggleA

Toggle a Source NAT rule's enabled state. DESTRUCTIVE: requires explicit confirmation.

ParametersJSON Schema
NameRequiredDescriptionDefault
uuidYes
confirmYes

TDQS

A4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description must fully disclose behavior. It states the tool is destructive and requires confirmation, but does not explain the exact toggle mechanism (e.g., inverting an enable flag) or whether changes require a subsequent apply (sibling opnsense_nat_apply exists).

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences with no wasted words: first states function, second warns of destructiveness. The purpose is front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple toggle with two parameters, the description covers the essentials. However, it omits that the change may not take effect until the apply tool (opnsense_nat_apply) is called, which is relevant context for the agent.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate. It reinforces the purpose of the confirm parameter ('requires explicit confirmation') and links uuid to the rule, but does not describe the uuid format or confirm's required value (already in schema).

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action ('Toggle') and the resource ('a Source NAT rule's enabled state'). It distinguishes from sibling tools like opnsense_nat_source_add (creates) and opnsense_nat_source_delete (removes).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies that this tool is used to change the enabled state and warns of destructiveness, but it does not explicitly state when to use vs. alternatives (e.g., opnsense_nat_source_update for other modifications) or mention any preconditions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

opnsense_nat_source_updateB

Update an existing Source NAT rule. Round-trips current config and only overrides explicitly provided fields. DESTRUCTIVE.

ParametersJSON Schema
NameRequiredDescriptionDefault
uuidYesRule UUID
enabledNo
interfaceNo
ipprotocolNo
protocolNo
source_netNo
source_notNo
source_portNo
destination_netNo
destination_notNo
destination_portNo
targetNo
target_portNo
staticnatportNo
nonatNo
logNo
sequenceNo
taggedNo
descriptionNo
confirmYes

TDQS

B3/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description mentions round-trip and destructive behavior, but with no annotations, it fails to explain specific effects, permissions, or irreversible actions beyond the vague term 'DESTRUCTIVE'.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is short and to the point, but the all-caps 'DESTRUCTIVE' could be better integrated; overall minimal waste.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given 20 parameters and no output schema or annotations, the description is woefully incomplete, missing field semantics, error behavior, and return format.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters1/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With only 5% schema description coverage (only uuid described) and no parameter explanations in the description, the agent cannot understand what each field controls or how to set them.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action (update) and the resource (existing Source NAT rule), distinguishing it from sibling tools like add, delete, or toggle.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It implies usage for modifying existing rules but lacks explicit guidance on when not to use it or alternatives like toggle or delete.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

opnsense_route_addA

Add a static route. The gateway parameter must be a gateway name from opnsense_route_gateway_list. Run opnsense_route_apply afterwards to activate.

ParametersJSON Schema
NameRequiredDescriptionDefault
networkYesDestination network in CIDR notation (e.g., 100.64.0.0/10)
gatewayYesGateway name or UUID (use opnsense_route_gateway_list to find available gateways)
disabledNoWhether the route is disabled (default: false)
descriptionNoOptional description

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description bears full burden. It discloses the additive operation and the need for activation via apply. It does not mention side effects, permissions, or limits, but for a simple add tool this is adequate and clearly conveys non-read-only nature.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short, front-loaded sentences. Each sentence serves a purpose: stating the action and providing workflow guidance (prerequisite and follow-up). No fluff or repetition.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no output schema and low complexity, the description covers the essential: purpose, key parameter constraint, and activation step. The optional parameters are self-explanatory from the schema, so the description is complete enough for correct tool invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so baseline is 3. The description reiterates the gateway constraint already in the schema ('must be a gateway name from opnsense_route_gateway_list'), adding no new parameter-level meaning beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states 'Add a static route,' which is a specific verb+resource. It distinguishes from sibling tools like delete, update, list by context and explicit workflow mention (gateway list prerequisite, apply afterwards).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides clear directives: use a gateway from opnsense_route_gateway_list, and run opnsense_route_apply to activate. However, it doesn't explicitly compare with alternatives like update or delete, though the tool name and sibling list make the distinction implicit.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

opnsense_route_applyA

Apply static route configuration changes (reconfigure routing)

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A3.5/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries full burden for behavioral disclosure. It only states the operation ('apply'), implying mutation but offering no details on side effects (e.g., service restart, idempotency, permission requirements, or what happens if no changes exist). This is insufficient for an agent to assess risks or consequences.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, front-loaded sentence that efficiently communicates the tool's function. Every word is meaningful, and there is no extraneous information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple apply tool with no parameters and no output schema, the description is adequate but minimal. It lacks usage guidance and behavioral transparency, which are important for an agent to use the tool correctly in a workflow. The presence of sibling apply tools (e.g., opnsense_fw_apply) further underscores the need for more context.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters, so no parameter description is needed. Baseline for 0 parameters is 4. The description does not add anything about the lack of parameters, but this is acceptable since the schema already conveys the empty input.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action ('Apply') and the resource ('static route configuration changes'), with a parenthetical clarification. The tool name reinforces this, making the purpose unambiguous and distinct from sibling tools like opnsense_route_add or opnsense_fw_apply.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No usage guidelines are provided. The description does not indicate when to use this tool (e.g., after making route modifications) or contrast it with alternatives like opnsense_route_gateway_apply or other apply tools. The agent must infer usage context from the name alone.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

opnsense_route_deleteA

Delete a static route. Run opnsense_route_apply afterwards to activate.

ParametersJSON Schema
NameRequiredDescriptionDefault
uuidYesUUID of the route to delete

TDQS

A4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden. It discloses the need to apply after deletion, which is a behavioral trait. However, it omits details like irreversibility or impact on active routes.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, front-loaded with the action, no unnecessary words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Adequately covers action and follow-up for a simple delete tool with one parameter and no output schema. Could mention permanence or prerequisites.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The description adds no meaning beyond the input schema, which already fully documents the uuid parameter. Baseline 3 applies due to high schema coverage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states 'Delete a static route', using a specific verb and resource, which distinguishes it from sibling tools like add, update, list, and apply.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It provides clear guidance by instructing to run opnsense_route_apply afterwards to activate, but does not explicitly exclude other uses or mention alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

opnsense_route_gateway_applyA

Apply pending gateway configuration changes (calls /api/routing/settings/reconfigure). Required after opnsense_route_gateway_update for changes to take effect. May briefly affect WAN connectivity. DESTRUCTIVE: requires explicit confirmation.

ParametersJSON Schema
NameRequiredDescriptionDefault
confirmYesMust be true to confirm the apply

TDQS

A4.3/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations exist, so description carries full burden. It discloses the API call, potential brief WAN disruption, and destructive nature requiring confirmation. Additional details like service restart behavior could enhance but are not critical.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three concise sentences, front-loaded with action and purpose, no redundant text. Every sentence adds value.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Tool is simple (one parameter, no output schema). Description explains necessity, effects, and usage context fully. No gaps for an agent to leverage.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema has 100% coverage with one parameter 'confirm' (boolean, enum true). Description mentions 'requires explicit confirmation' which adds mild context beyond schema, but baseline is appropriate as schema already documents the parameter well.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool applies pending gateway configuration changes, specifies the API endpoint, and distinguishes it from sibling tools like opnsense_route_gateway_update and opnsense_route_apply by noting it is required after an update.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly states when to use (after opnsense_route_gateway_update) and warns about potential WAN impact and required confirmation. Does not explicitly list conditions to avoid, but context is clear.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

opnsense_route_gateway_listA

List all available gateways (used as targets for static routes)

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4.3/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description clarifies it is a read-only list operation (no side effects), and adds context that gateways are used as targets for static routes. This is sufficient for a simple tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Single sentence of 11 words, front-loaded with the action and resource. No wasted words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Tool has no parameters or output schema; description completely covers its purpose (list gateways) and provides context (used as targets). No gaps.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has zero parameters, so baseline is 4. The description adds no parameter info (unnecessary) and does not need to compensate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description explicitly states it lists gates and specifies their use as targets for static routes, clearly distinguishing it from siblings like opnsense_route_gateway_status (status) or opnsense_route_add (add routes).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage for viewing gateways before adding routes, but does not explicitly state when to use this tool versus alternatives such as opnsense_route_gateway_status or opnsense_route_list. No exclusion criteria provided.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

opnsense_route_gateway_statusA

Get live gateway monitor status: per-gateway online/offline state, RTT (delay), packet loss, stddev, monitor IP, and monitor_disable flag. Read-only — complements opnsense_route_gateway_list (which only returns config).

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description fully carries the burden of behavioral disclosure. It correctly identifies the operation as read-only and lists the returned metrics (online/offline, RTT, packet loss, etc.). It does not mention potential side effects or access requirements, but for a simple query tool the transparency is strong.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences long, each serving a distinct purpose: first explaining what the tool returns, second placing it in context with a sibling. No extraneous words; information is front-loaded and efficient.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool has no parameters, no output schema, and no annotations, the description covers everything needed: purpose, output fields, and relationship to a sibling. It is complete enough for an agent to select and invoke the tool correctly without ambiguity.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has zero properties, so there are no parameters to explain. The description adds no parameter information because none exists. According to guidelines, with 0 parameters the baseline is 4, and the description meets that by not adding any unnecessary noise.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description clearly states the verb 'Get', the resource 'live gateway monitor status', and lists specific fields returned. It explicitly distinguishes from sibling tool opnsense_route_gateway_list by noting it complements the config-only list, making the purpose unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description says 'complements opnsense_route_gateway_list (which only returns config)', providing clear context for when to use this tool versus the sibling. It also marks the tool as read-only, but does not give explicit when-not-to-use scenarios or mention prerequisites, though the context is sufficient.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

opnsense_route_gateway_updateA

Update an existing gateway's settings (toggle monitoring, set monitor IP, change weight/priority, enable/disable). Round-trips current config and only overrides explicitly provided fields. After updating, call opnsense_route_gateway_apply to activate the change. DESTRUCTIVE: requires explicit confirmation.

ParametersJSON Schema
NameRequiredDescriptionDefault
uuidYesGateway UUID (from opnsense_route_gateway_list)
monitor_disableNoDisable gateway monitoring (true = no health probe)
monitorNoMonitor IP address (used when monitor_disable=false). Empty string clears it.
disabledNoDisable the gateway entirely
defaultgwNoMark as default gateway
descriptionNoHuman-readable description
weightNoLoad-balancing weight (1-30)
priorityNoFailover priority (1-255, lower = higher priority)
confirmYesMust be true to confirm the update

TDQS

A3.9/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description must disclose behavioral traits. It states the round-trip partial update behavior and the destructive/confirmation requirement. However, it does not explain error conditions, validation, or what happens on failure.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is four efficient sentences, each serving a purpose: purpose, behavior, activation step, and warning. No wasted words, front-loaded with key information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

No output schema is provided, and the description does not specify the return value or response format. While the round-trip behavior and activation step are covered, a complete tool definition should indicate what the agent can expect back.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so each parameter is well-documented in the schema. The description adds overarching context (round-trip, only override provided fields) but does not enrich individual parameter meanings beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description explicitly states 'Update an existing gateway's settings' and lists specific fields (monitoring, monitor IP, weight/priority, enable/disable). It distinguishes from sibling tools like opnsense_route_gateway_apply by noting that an apply call is needed after update.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explains the round-trip behavior (only overrides provided fields) and directs the agent to call opnsense_route_gateway_apply afterward. It also warns 'DESTRUCTIVE: requires explicit confirmation,' tying to the confirm parameter. It could explicitly mention alternatives but is clear.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

opnsense_route_listA

List all configured static routes

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A3.5/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It does not explicitly state that the tool is read-only or has no side effects, but for a list operation this is somewhat implicit. It could mention that it does not modify state or require special permissions.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence with no extraneous words. It is perfectly concise and front-loaded with the core action.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool has no output schema, so the description should ideally describe what is returned. It only states it lists routes but omits details like fields (gateway, interface, etc.) or any limitations. For a simple list tool, this is acceptable but not complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has no parameters, and schema coverage is 100%. The description adds no parameter-level meaning, but since there are none, a baseline of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb 'List' and the resource 'all configured static routes', distinguishing it from sibling tools like opnsense_route_add, opnsense_route_delete, etc. However, it could be slightly more explicit that it only returns static routes, especially since opnsense_diag_routes might list routes of other types.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description does not provide explicit when-to-use or when-not-to-use guidance. It is implied that this tool is for listing static routes while others handle modifications, but no alternatives (like diag_routes) are mentioned. The context is clear but lacks exclusions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

opnsense_route_updateB

Update an existing static route. Run opnsense_route_apply afterwards to activate.

ParametersJSON Schema
NameRequiredDescriptionDefault
uuidYesUUID of the route to update
networkNoDestination network in CIDR notation
gatewayNoGateway name or UUID
disabledNoWhether the route is disabled
descriptionNoOptional description

TDQS

B3.2/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure. It only states 'update' without explaining whether it is a partial update, if validation occurs, or what side effects exist (e.g., whether network or gateway changes disrupt traffic). The description does not reveal other behavioral traits.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is extremely concise: two sentences, each serving a distinct purpose (stating the action and giving a procedural note). There is no wasted text, and the key information is front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool has 5 parameters, no output schema, and no annotations, the description is too brief to provide complete context. It does not explain what happens if required fields are omitted (uuid is required), how to find the uuid, or whether the update is immediate. The procedural note about applying is helpful but insufficient for a comprehensive understanding.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 100% description coverage, so each parameter's meaning is already clear from the schema. The description adds no extra meaning beyond stating the tool's action. Therefore, a baseline score of 3 is appropriate as the schema already does the heavy lifting.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb 'Update' and resource 'existing static route', making it easy to understand the tool's core function. However, it does not explicitly differentiate from sibling tools like 'opnsense_route_add' or 'opnsense_route_delete', though the name itself provides some distinction.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description includes an important procedural guideline: 'Run opnsense_route_apply afterwards to activate.' This tells the agent the post-update step. However, it lacks guidance on when to use this tool instead of alternatives, such as when to add a new route vs update, and no prerequisites (e.g., needing the UUID from a list).

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

opnsense_svc_controlB

Start, stop, or restart a service by name

ParametersJSON Schema
NameRequiredDescriptionDefault
service_nameYesName of the service (e.g. 'unbound', 'openssh', 'configd')
actionYesAction to perform on the service

TDQS

B3.4/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided. The description indicates a mutation operation but does not disclose potential side effects, error conditions, or permission requirements. Minimal behavioral context beyond the obvious.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, efficient sentence with no redundant words. It is concise and directly to the point.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple tool with two clear parameters and no output schema, the description covers the core functionality. However, it does not mention return values or confirmation of action, which might be expected.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% and clearly defines both parameters with descriptions and an enum for action. The description adds no meaningful extra meaning beyond what the schema provides.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb and resource: 'Start, stop, or restart a service by name.' It specifies the actions and the target, distinguishing it from sibling tools like 'opnsense_svc_list'.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides no guidance on when to use this tool versus other service-related tools. No mention of prerequisites, alternatives, or when not to use it.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

opnsense_svc_listA

List all services and their running status

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A3.7/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden of behavioral disclosure. The description only states the basic function without revealing whether the operation is read-only, requires authentication, or has any side effects. For a simple list operation, this is a notable gap.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description consists of a single sentence that efficiently conveys the tool's purpose. It is concise, front-loaded with the action 'List all services', and contains no extraneous information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool is simple (no parameters, no output schema), but the description does not hint at the structure of the response (e.g., service name, status format). While the information provided is sufficient for basic usage, mentioning the return format would enhance completeness.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters and the input schema is empty, so schema coverage is 100%. The description does not need to add parameter information; the baseline for zero parameters is 4. The description adds no meaning beyond the schema, but none is required.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly specifies the tool's purpose: 'List all services and their running status'. It uses a specific verb ('List') and resource ('services'), and the addition of 'running status' distinguishes it from other list tools, such as opnsense_dhcp_list_leases or opnsense_fw_list_rules, which list different resources.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies that the tool is used to retrieve service status, which is straightforward. However, it provides no explicit guidance on when to use this tool versus alternatives like opnsense_svc_control (which likely controls services) or other service-related tools. No exclusions or prerequisite conditions are mentioned.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

opnsense_sys_backup_downloadA

Download an OPNsense configuration backup as XML. Downloads the current running config if no backup_id is specified.

ParametersJSON Schema
NameRequiredDescriptionDefault
backup_idNoSpecific backup ID to download (e.g. 'config-1773423430.7934.xml'). Omit to download the current running config.

TDQS

A3.8/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided, so description bears full burden. Only states it downloads backup; does not disclose permissions required, error handling, or confirm read-only nature. Minimal behavioral context beyond the obvious.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short sentences, front-loaded with verb and resource. No unnecessary words; every sentence serves a purpose.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple tool with one optional parameter and no output schema, description is fairly complete. Could explicitly mention return format (XML) but that's implied. Adequate for agent decision-making.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema covers 100% of parameters with descriptions. The tool description adds value by clarifying that omitting backup_id downloads the current running config, which is not in the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Clearly states the tool downloads an OPNsense configuration backup as XML. Distinguishes from siblings like opnsense_sys_backup_list and opnsense_sys_backup_revert by specifying the download action.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides some guidance: when to omit backup_id to download the current config. However, no explicit when-not or alternatives to other backup tools are given.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

opnsense_sys_backup_listA

List all configuration backups stored on the OPNsense filesystem with timestamps, descriptions, and file sizes

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided. Description does not disclose behavioral traits beyond listing backups. It omits mention of side effects (none expected) or access requirements. For a read-only tool, this is adequate but minimal.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Single sentence, 14 words, front-loaded with verb and resource. No unnecessary information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Tool has no parameters and no output schema. Description covers the return fields and resource. Could mention that it lists all backups or that it is non-destructive, but overall sufficient for a simple list operation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Input schema has no parameters (100% coverage), so baseline is 4. Description adds value by specifying the output fields (timestamps, descriptions, file sizes), compensating for the lack of output schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description clearly states the verb 'list' and the resource 'configuration backups' with specific return fields (timestamps, descriptions, file sizes). Distinct from sibling tools opnsense_sys_backup_download and opnsense_sys_backup_revert.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No explicit guidance on when to use vs alternatives, but the clear purpose and lack of similar listing tools make it obvious. The description could mention that it's a read-only operation to list backups before download/revert.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

opnsense_sys_backup_revertA

Revert OPNsense configuration to a previous backup. DESTRUCTIVE: replaces the running config with the specified backup.

ParametersJSON Schema
NameRequiredDescriptionDefault
backup_idYesBackup ID to revert to (e.g. 'config-1773423430.7934.xml'). Use opnsense_sys_backup_list to see available backups.

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description fully carries the burden. It clearly states the tool 'replaces the running config with the specified backup' and marks it as 'DESTRUCTIVE', which is strong behavioral disclosure. It does not mention potential side effects like reboot or impact on services, but for a simple revert operation it is adequate.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences: the first immediately conveys the purpose, the second adds the critical destructive warning and a practical hint. No superfluous words. The structure is front-loaded with the most important information first.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's simplicity (single parameter, no output schema), the description is nearly complete. It covers purpose, destructive behavior, and parameter sourcing. It could be improved by mentioning what the agent should expect after execution (e.g., success message or verification steps), but overall it is sufficient.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 100% coverage for its single parameter, 'backup_id'. The description adds meaning beyond the schema by directing the agent to use opnsense_sys_backup_list to find available backup IDs, and the schema itself provides a format example. This combination effectively guides parameter usage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action 'Revert' on the resource 'OPNsense configuration' and specifies the scope 'to a previous backup'. It distinguishes itself from siblings like opnsense_sys_backup_list (listing) and opnsense_sys_backup_download (downloading) by indicating the destructive nature.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies when to use (to revert config) and gives a clear prerequisite: 'Use opnsense_sys_backup_list to see available backups.' It explicitly labels the action as 'DESTRUCTIVE', warning the agent. However, it does not provide explicit when-not-to-use scenarios or list alternative tools.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

opnsense_sys_infoA

Get system status information (hostname, versions, CPU, memory, uptime, disk usage)

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description bears the full burden. It correctly indicates a read-only operation ('Get'), which implies no destructive effects. However, it does not explicitly state that the operation is safe, idempotent, or discuss any authentication requirements or rate limits. A 3 is appropriate given the straightforward nature but lack of explicit behavioral details.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence that is front-loaded with the action and resource, then enumerates key details in parentheses. Every word earns its place, no redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's simplicity (no parameters, no output schema), the description is nearly complete. It lists the main categories of returned information, providing sufficient context for an agent to understand what to expect. It could be improved by mentioning the format or structure (e.g., JSON object), but is otherwise adequate.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has zero parameters and schema coverage is 100%. The baseline for no parameters is 4. The description adds meaning by listing the specific data fields that will be returned (CPU, memory, etc.), which goes beyond the empty schema and helps the agent understand the tool's output.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb 'Get' and resource 'system status information', and explicitly lists the included metrics (hostname, versions, CPU, memory, uptime, disk usage). This clearly distinguishes it from sibling diagnostic tools like 'opnsense_diag_system_info' which might have a broader or different scope.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage for retrieving system status but provides no explicit guidance on when to use this tool versus alternatives such as 'opnsense_diag_system_info'. There are no when-not or exclusions stated, making it adequate but not explicit.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

opnsense_sys_list_certsA

List all certificates in the OPNsense trust store with their refids, descriptions, and validity dates

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the entire burden. It states the tool lists certificates, implying a read-only operation, but does not disclose potential prerequisites, authentication needs, or whether the trust store is local or remote. For a simple list tool, this is adequate but not enriched.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence with no wasted words, front-loaded with the action verb 'List'. It efficiently communicates the tool's purpose and output.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool has no parameters and no output schema, the description specifies the resource ('OPNsense trust store') and the returned fields (refids, descriptions, validity dates). This is sufficient for an agent to understand what the tool returns. Minor omission: no mention of potential limits or pagination, but these are unlikely for a certificate list.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters, and the input schema is fully covered (100% empty). The description does not need to add parameter meaning. The baseline score for no parameters is 4, and the description meets it without needing extra detail.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('List') and clearly identifies the resource ('certificates in the OPNsense trust store') and the returned fields (refids, descriptions, validity dates). It distinguishes from sibling tools because no other tool lists trust store certificates; ACME tools list ACME-managed certs, not the system trust store.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies it is for viewing all trust store certificates, but it does not explicitly state when to use it versus alternatives (e.g., ACME certificate listing). While no direct competitor exists, providing context about its scope vs. ACME tools would improve guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

opnsense_tailscale_service_controlA

Control the Tailscale service: start, stop, restart, or reconfigure (apply settings changes).

ParametersJSON Schema
NameRequiredDescriptionDefault
actionYesService action to perform

TDQS

A4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided, so description carries burden. It states actions but lacks details on side effects (e.g., downtime, prerequisites). Minimal but not misleading.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Single sentence with no wasted words. Front-loaded purpose. Highly efficient.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's simplicity (1 param, no output schema), description covers actions well. Lacks mention of admin requirements or relation to service status tool, but adequate for the complexity.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% with enum values. Description adds value by explaining 'reconfigure (apply settings changes)', which clarifies the action beyond the schema enum.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description clearly states the verb 'Control' and resource 'Tailscale service', listing four specific actions (start, stop, restart, reconfigure). Differentiates from sibling tools like opnsense_svc_control by specifying Tailscale.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Describes actions but does not explicitly guide when to use this tool versus alternatives like opnsense_svc_control or opnsense_tailscale_service_status. No exclusion criteria or context provided.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

opnsense_tailscale_service_statusA

Check if the Tailscale service (tailscaled) is running.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description must convey behavioral traits. It states the action is a check, implying no side effects, but it does not describe the return format (e.g., boolean, string) or any edge cases. This is acceptable for a simple read operation but leaves some ambiguity.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, concise sentence that immediately communicates the tool's function. It is front-loaded and wastes no words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the simplicity of the tool (no parameters, no output schema), the description is nearly complete. However, it would benefit from briefly indicating what the output looks like, e.g., 'returns whether the service is running or not.' This minor gap prevents a perfect score.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has no parameters, so the description does not need to add meaning beyond the schema. The baseline score for 0 parameters is 4, and the description provides no unnecessary detail.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: to check if the Tailscale service is running. It uses a specific verb ('Check') and resource ('Tailscale service'), and it distinguishes itself from the sibling tool 'opnsense_tailscale_service_control' which controls the service.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description does not provide explicit guidance on when to use this tool versus alternatives. While the sibling tool for service control implies a distinction, the description itself lacks contextual cues or recommendations for typical usage flows.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

opnsense_tailscale_settings_getA

Get current Tailscale plugin settings (enabled, port, auth-key, advertise-routes, accept-routes, accept-dns, exit-node).

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4.2/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description must cover behavioral aspects. It correctly implies a read-only operation by using 'Get', but it does not disclose potential side effects, authentication requirements, or response format. Adding details about the output structure would enhance transparency.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, well-structured sentence that front-loads the purpose and lists relevant details. There is no redundant information, making it highly concise and efficient.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the lack of parameters and output schema, the description is reasonably complete. It specifies the resource and the data fields retrieved. However, for a tool with no annotations, mentioning the return type (e.g., JSON object) would increase completeness.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has no parameters, so the description does not need to explain parameter semantics. The schema coverage is 100%. The description still adds value by enumerating the settings returned, which aids understanding of the output.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool retrieves current Tailscale plugin settings and lists the specific settings (enabled, port, auth-key, etc.). It uses a specific verb ('Get') and resource ('Tailscale plugin settings'), which distinguishes it from sibling tools like opnsense_tailscale_settings_set and opnsense_tailscale_service_control.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies the tool is for reading settings, and the sibling setter tool is available for modifications, but it does not explicitly state when to use this versus alternatives. A brief note about using 'opnsense_tailscale_settings_set' for updates would improve clarity.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

opnsense_tailscale_settings_setA

Update Tailscale plugin settings. Only provided fields are changed. Run opnsense_tailscale_service_control with action 'reconfigure' afterwards to apply.

ParametersJSON Schema
NameRequiredDescriptionDefault
enabledNoEnable (1) or disable (0) the Tailscale service
portNoUDP port for Tailscale (default: 41641)
auth_keyNoTailscale auth key for automatic enrollment
advertise_routesNoComma-separated CIDR list to advertise as subnet routes (e.g. '10.10.0.0/24')
advertise_exit_nodeNoAdvertise as exit node (1) or not (0)
accept_routesNoAccept routes from other nodes (1) or not (0)
accept_dnsNoAccept DNS configuration from tailnet (1) or not (0)

TDQS

A3.7/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries full burden. It mentions the partial update behavior and the need for reconfiguration, but does not disclose idempotency, validation, error behavior, or side effects beyond the note. Adequate but not thorough.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, no fluff. The first sentence states the action and resource, the second provides essential post-step instruction. Every word earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description omits return value or output behavior. It does not mention whether the operation is synchronous or what it returns (e.g., success status). The post-step is included, but overall completeness is average for a set tool with 7 parameters and no output schema.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% with individual parameter descriptions. The description adds no further semantic detail beyond reinforcing that only provided fields change. Baseline 3 is appropriate as the schema already covers the parameters well.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states 'Update Tailscale plugin settings' which specifies the verb and resource. It also notes that only provided fields are changed, distinguishing it from a full replacement. The sibling tools include a getter and service control, so the purpose is well-defined.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides a critical post-step (run service reconfigure) but lacks explicit guidance on when to use this tool versus alternatives. There is no mention of when not to use it or references to sibling tools like the getter or service control for other actions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

opnsense_vlan_createA

Create a new 802.1Q VLAN interface on a parent interface. After create, run opnsense_if_assign to bind the VLAN to a logical interface (opt1, opt2, ...) and opnsense_if_configure to assign an IP.

ParametersJSON Schema
NameRequiredDescriptionDefault
parent_interfaceYesParent physical interface device name (e.g. 're0', 'igb0')
vlan_tagYes802.1Q VLAN ID (1-4094)
descriptionNoHuman-readable description of the VLAN
priorityNo802.1p priority (0-7, default 0)

TDQS

A4.2/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It states the creation action but lacks details on prerequisites, error handling, or idempotency. It does add value by noting that additional steps are required for full functionality, but more behavioral context would improve transparency.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is extremely concise, consisting of just two sentences. The first states the purpose, and the second provides critical follow-up instructions. Every word earns its place with no redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a creation tool without an output schema, the description is largely complete. It explains the main action and the necessary subsequent steps. However, it does not mention whether the VLAN is immediately active or if any apply action is needed, but the presence of sibling tools like opnsense_if_configure fills some gaps.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 100% description coverage, so each parameter is already well-documented. The tool description does not add new meaning beyond the schema, achieving only the baseline of 3.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states 'Create a new 802.1Q VLAN interface on a parent interface,' specifying the exact verb and resource. It distinguishes from sibling tools like opnsense_vlan_delete, opnsense_vlan_list, and opnsense_vlan_update, which perform different actions.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides explicit post-creation steps: 'After create, run opnsense_if_assign to bind the VLAN to a logical interface and opnsense_if_configure to assign an IP.' This tells the agent exactly what to do next, leaving no ambiguity.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

opnsense_vlan_deleteA

Delete a VLAN interface by UUID. Fails if the VLAN is still assigned to a logical interface — unassign it first via opnsense_if_assign.

ParametersJSON Schema
NameRequiredDescriptionDefault
uuidYesUUID of the VLAN to delete

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the burden of behavioral disclosure. It reveals that the tool will fail if the VLAN is assigned, which is a key behavioral trait. However, it does not mention outcomes for non-existent UUIDs or any other side effects, but for a simple delete, the provided information is adequate.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is extremely concise: two sentences with no wasted words. The first sentence states the primary purpose, and the second adds a crucial precondition. It is front-loaded and efficient.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool only has one parameter and no output schema or annotations, the description is fairly complete. It covers the action, the required UUID, the failure condition, and the prerequisite. However, it does not describe typical output or handling of invalid UUIDs, but for a delete operation, this is sufficient for correct agent usage.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema description coverage is 100% with the parameter description 'UUID of the VLAN to delete'. The description adds no extra semantic meaning beyond what the schema already provides, so it meets the baseline of 3.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states 'Delete a VLAN interface by UUID', specifying the action (delete) and resource (VLAN interface). It distinguishes from sibling tools like opnsense_vlan_create, opnsense_vlan_list, and opnsense_vlan_update by focusing on deletion and mentioning a prerequisite.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly states when not to use: 'Fails if the VLAN is still assigned to a logical interface — unassign it first via opnsense_if_assign.' This provides clear guidance on prerequisites and an alternative action, directing the agent to use opnsense_if_assign first.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

opnsense_vlan_listA

List all configured 802.1Q VLAN interfaces (parent interface, VLAN tag, description, priority)

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4.3/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the burden of behavioral disclosure. It implies a read-only operation by listing interfaces, but does not explicitly state that it is safe or non-destructive. Adequate but could be improved with a safety mention.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, front-loaded sentence that efficiently communicates the tool's purpose and output fields. Every word earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a parameter-less list tool with no output schema, the description provides sufficient context by specifying the output fields. No additional information is necessary for an agent to understand what the tool returns.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has no parameters, and schema description coverage is 100%. The description adds no parameter information because none is needed. Baseline for zero parameters is 4, and the description appropriately states the output fields.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it lists 802.1Q VLAN interfaces and specifies the exact fields returned (parent interface, VLAN tag, description, priority). This distinguishes it from sibling tools like opnsense_vlan_create, opnsense_vlan_delete, and opnsense_vlan_update.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description indicates the tool lists all configured VLANs, making its use case clear. It doesn't explicitly state when not to use it or provide alternatives, but the sibling tool names imply this is for viewing only, creating a clear context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

opnsense_vlan_updateA

Update an existing VLAN interface by UUID. Only provided fields are changed.

ParametersJSON Schema
NameRequiredDescriptionDefault
uuidYesUUID of the VLAN to update
parent_interfaceNoParent physical interface device name
vlan_tagNo802.1Q VLAN ID (1-4094)
descriptionNoDescription
priorityNo802.1p priority (0-7)

TDQS

A3.5/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations exist, so the description should provide behavioral context. It only states 'Update' and partial updates, missing details on authorization, side effects, or reversibility.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two concise sentences with no unnecessary words. Front-loaded with the action and resource.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool has 5 parameters and no output schema. The description covers the core operation but lacks details on return values, errors, or prerequisites, leaving some gaps.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the baseline is 3. The description adds no additional parameter meaning beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action ('Update'), the resource ('VLAN interface'), and the identifier ('by UUID'). It distinguishes from sibling tools like opnsense_vlan_create and opnsense_vlan_list.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description indicates partial updates ('Only provided fields are changed'), but no explicit guidance on when to use vs alternatives or prerequisites.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

TDQS

A3.9/5.0
Disambiguation5/5

Each tool is clearly scoped to a specific subsystem and action (e.g., opnsense_acme_, opnsense_fw_). Within subsystems, tools for different CRUD operations or diagnostics are distinct. The 'apply' tools are disambiguated by subsystem prefix. No overlapping purposes.

Naming Consistency5/5

All tools follow a consistent pattern: 'opnsense_<subsystem>_<verb>[_<object>]' (e.g., opnsense_acme_add_account, opnsense_dhcp_list_leases). Verbs are predictable (add, delete, list, update, apply, etc.). Mixed use of 'list' vs 'get' is consistent within subsystems.

Tool Count4/5

112 tools is high but not excessive given OPNsense's extensive functionality (ACME, DHCP, DNS, firewall, NAT, routes, VLANs, system, etc.). The tools are well-organized by prefix, so the count feels necessary rather than bloated. Slightly above the typical range but still reasonable.

Completeness4/5

Most subsystems have full CRUD coverage (e.g., firewall rules, DNS overrides, VLANs). Diagnostic tools cover common network troubleshooting. Minor gaps: no update for ACME accounts, no update for DHCP static mappings (only delete/add). Overall, the surface is comprehensive and covers core workflows.

Maintenance

ActivityInactive
ResponsivenessSyncing

Resources

Unclaimed servers have limited discoverability.

Looking for Admin?

If you are the server author, to access and configure the admin panel.

Related MCP Connectors

Related MCP Servers

  • A
    license
    B
    quality
    C
    maintenance
    Slim Cloudflare MCP Server — 42 tools for managing DNS, zones, tunnels, WAF, Zero Trust, and security via Cloudflare API v4. Multi-zone support. No SSH, no shell, API-only with 3 runtime dependencies. AGPL-3.0 + Commercial dual-licensed.
    96
    65
    AGPL 3.0
  • A
    license
    A
    quality
    B
    maintenance
    A secure MCP server for managing OPNsense firewalls through AI assistants. Provides 81 tools across system, firewall, network, DNS, DHCP, VPN, HAProxy, services, diagnostics, and security domains.
    81
    12
    MIT
  • A
    license
    Not graded
    quality
    C
    maintenance
    Provides complete programmatic access to OPNsense core APIs, enabling firewall automation, VPN management, and system administration through a comprehensive MCP server.
    MIT

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/itunified-io/mcp-opnsense'

If you have feedback or need assistance with the MCP directory API, please join our Discord server