Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations present, the description carries the full burden of safety disclosure, and it does disclose both 'Read-only' and 'Does not modify any AWS resources'. This is meaningful and directly reduces the risk of misuse, though it doesn't cover follow-on effects such as rate limits or network side effects.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is short and front-loaded, with a clear purpose followed by a safety note. 'Read-only' and 'Does not modify any AWS resources' are slightly redundant, but the whole description stays compact and usable.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a read-only detection tool with two optional parameters and no output schema, this description gives enough to invoke it safely. However, it never states what the invocation returns — the declared services list, a boolean, or a report — so an agent must infer the result shape at call time.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema already gives 100% parameter coverage, fully describing region and provider defaults, plus the Huawei Cloud nuances. The description adds no parameter-specific detail, so the baseline applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description explicitly says to run the 'Security Service Detection security scanner', giving a concrete action and a named scanner scope. It includes 'only' to signal that this is a focused scan rather than a report or list, though it does not distinguish among the many sibling scan_* tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is given about when to choose this tool over alternatives such as scan_all, scan_and_report, or scan_security. The word 'only' hints at a narrow scope but doesn't name exclusions or selection criteria. The agent is left to infer appropriate usage.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries full burden but only mentions generation and saving. It lacks details on output location, file overwrite behavior, permissions, or any side effects beyond file creation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, front-loaded with purpose, no redundancy. Could be improved with more context, but it is appropriately concise.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given 4 parameters and no output schema, the description does not explain how parameters affect the report, what the report contains, or dependencies like requiring prior scan results. Important gaps remain.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so baseline is 3. The description adds no additional parameter information beyond the schema definitions, which already describe each parameter adequately.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool generates a professional HTML security report and saves as .html file, specifying the output format. However, it does not differentiate from sibling tools like generate_mlps3_html_report, which also produces HTML.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this tool versus other report generators (e.g., generate_report, generate_maturity_report). No prerequisites or context for invocation are provided.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description must disclose all behavioral traits. It only states the output format (HTML) and that it is saved as a file, but does not mention where it is saved, if it overwrites existing files, any authentication requirements, or side effects like file creation. This is insufficient for safe invocation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise at two sentences, front-loaded with the core purpose, and contains no redundant or irrelevant information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description lacks information about return values or output behavior (e.g., file path, overwrite behavior). Given there is no output schema, the description should clarify what the agent can expect after invocation, but it does not.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% (all parameters have descriptions in the schema). The description adds no new information about parameters beyond what is in the schema, so it meets the baseline but does not enhance understanding.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb (generate), resource (HTML report), and the specific organization criteria (HW Defense SOP checklist categories). This makes it distinct from sibling tools like 'generate_html_report' which would produce a more generic report.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides no guidance on when to use this tool versus alternatives like 'generate_html_report' or 'generate_maturity_report'. There is no mention of prerequisites, exclusions, or context-driven recommendations.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, but the description explicitly states 'Read-only', which is a key behavioral trait. It also mentions the dependency on service_detection output. However, it lacks details on state changes, return format, or safety beyond the read-only claim.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is extremely concise at two sentences, covering purpose, precondition, and safety in a front-loaded manner. Every sentence serves a clear purpose with no redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given there is no output schema, the description fails to explain what the report contains or its return format (e.g., file path, string). This leaves the agent without necessary information to handle the tool's output, making it incomplete for a report generation tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3. The description does not add meaning beyond what the input schema already provides for the two parameters (scan_results and lang).

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it generates a security maturity assessment report from scan_all results, with a specific verb and resource. It mentions dependency on service_detection module output, which adds context but does not explicitly differentiate from sibling report generators like generate_report or generate_html_report.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description indicates that the tool requires service_detection module output, providing a precondition for use. However, it does not give guidance on when to use this tool over siblings or when not to use it, leaving the agent to infer usage context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description should disclose behavioral traits. It only states the outcome (generate report) but does not mention whether it is a read-only operation, if it requires specific permissions, or if it modifies any state. The description is insufficient for an agent to understand side effects.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise with two sentences, no unnecessary words. It is front-loaded with the purpose. Could be slightly more structured, but overall efficient.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool has 4 parameters and no output schema. The description does not explain what the tool returns or where the .html file is saved (e.g., local path, downloadable link). It also does not indicate if history is required for trend charts, leaving the agent to infer from parameter descriptions.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so parameters are well-documented in the schema. The description adds no extra meaning beyond what is in the schema, so baseline score of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it generates a professional HTML MLPS Level 3 compliance report and saves as .html file. It distinguishes from siblings like generate_mlps3_report by specifying HTML format, but could more explicitly differentiate when to use this versus other report generators.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this tool versus alternatives. Does not mention prerequisites, such as running scan_group mlps3_precheck first to obtain scan_results. Lacks context on which scenarios this report is appropriate for.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Declares 'Read-only', indicating no side effects. No annotations provided, so description carries full burden. Does not detail other behavioral traits but the read-only flag is strong.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences with no redundancy. Purpose and usage immediately stated. Every sentence earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

No output schema, but description adequately covers input and behavior. Could mention output format (e.g., HTML, PDF) but not critical for a report generator.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so baseline is 3. Description adds value by clarifying that scan_results should come from mlps3_precheck, enriching parameter meaning.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool generates a GB/T 22239-2019 等保三级 compliance pre-check report from scan results. It specifies the standard and compliance level, and distinguishes from siblings like generate_html_report or generate_maturity_report.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly recommends usage with 'scan_group mlps3_precheck results', providing clear context when to use. Could further exclude alternatives but is sufficiently clear.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description fully discloses read-only behavior and the fact that no AWS resources are modified. This is critical safety information for the agent. It does not cover any potential edge cases or error handling, but the core behavioral trait is clear.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences long, front-loads the key action and output format, and includes the critical read-only note. Every sentence adds value with no wasted words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple tool with three documented parameters and no output schema, the description covers the essential context: what it does, that it's read-only, and the input source. It does not mention the exact output structure or prerequisites, but the param descriptions compensate.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents all three parameters thoroughly. The description adds only the context that the report is from scan results, which aligns with the scan_results parameter description. No additional parameter-level semantics are provided beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool generates a Markdown security report from scan results, a specific verb+resource combination. While it distinguishes itself from scanning siblings, it does not explicitly differentiate from other report-generating siblings like generate_html_report.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies the tool should be used after obtaining scan results from 'scan_all', but it provides no explicit guidance on when to choose this over alternative report tools, nor any when-not scenarios.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description explicitly states that the server performs no LLM calls, a key behavioral trait. It also outlines the expected workflow (passing the prompt output to a report tool). With no annotations provided, this disclosure is critical and well-done.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences long, front-loaded with the core purpose, and contains no filler. Every sentence adds value, including the crucial note about no LLM calls.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given three parameters, no output schema, and no annotations, the description adequately explains the tool's function, return value (a prompt), and usage workflow. It could be slightly more specific about the prompt's structure, but it remains complete enough for an AI agent to use correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% with good parameter descriptions. The description adds context by explaining each enum value's meaning and the scan_results parameter format, reinforcing the schema information. It provides additional clarity beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it returns a report-type-tailored prompt for AI security summaries, with explicit mention of no LLM calls. It distinguishes from sibling report-generation tools by focusing on prompt generation rather than direct report output.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

It specifies when to use (to make summaries specific to report type) and lists supported report types. It implies the workflow of passing generated text back to a report tool. However, it does not explicitly state when not to use or name alternative tools for direct report generation, but the context from sibling tools makes it clear.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description provides one behavioral trait ('Read-only') but lacks additional detail such as authorization needs, rate limits, or potential side effects. Since no annotations are provided, the description carries the full burden for transparency, which it partially fulfills.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence with no unnecessary words. It is front-loaded and efficient, delivering key information immediately.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple tool with one optional parameter and no output schema, the description adequately covers its purpose and behavior. It could mention the output format implications or typical use cases, but is largely complete given the low complexity.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% with one parameter (format) fully described via enum. The description adds 'Read-only' but no additional parameter-level meaning beyond what the schema provides. Baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool returns a CloudFormation StackSet template for deploying a cross-account security audit IAM role. It includes a specific verb ('Returns') and resource, and is distinct from sibling tools which are mostly scan and report functions.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage but does not explicitly state when to use this tool versus alternatives or when not to use it. There is no mention of prerequisites or context for choosing this tool over others.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries full burden. It clearly states the tool is read-only, which is a key behavioral trait. However, it lacks details on permissions or rate limits, though for a simple list tool this is acceptable.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short sentences, no wasted words. The core action and read-only nature are front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given zero parameters and no output schema, the description adequately covers the tool's purpose and behavior. It could mention that output can be used with scan_group, but it is not necessary for completeness.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

No parameters exist (0 params), so baseline is 4. The description does not need to compensate for schema coverage since there are no parameters to document.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

Description clearly states the tool lists available scan groups with descriptions and is read-only. The verb 'list' and resource 'scan groups' are specific, and the 'read-only' qualifier distinguishes it from sibling mutation tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

No explicit guidance on when to use this tool vs alternatives. The context implies it is for discovering groups before scanning, but no alternatives or when-not-to-use are mentioned.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description explicitly states 'Read-only. Does not modify any AWS resources,' which is valuable behavioral disclosure. However, no annotations are provided, so the description carries the full burden; it could add more context about output format or whether it queries live AWS APIs, but the safety guarantee is clearly stated.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short sentences with no waste. The core purpose and the read-only guarantee are front-loaded, and every word earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple list tool with one optional parameter and no output schema, the description is nearly complete. It could mention what the returned list contains (names, descriptions) but the description already says 'with descriptions.' The read-only note covers the main safety concern.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents the provider parameter thoroughly. The description adds no additional parameter semantics beyond what the schema provides, so baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb ('List') and resource ('available security scan modules') and explicitly notes it is read-only. It distinguishes itself from the many sibling scan_* tools by being the listing tool rather than a scanning tool.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description clearly indicates this is for listing modules, not running scans, and the read-only note implies it is safe to call for discovery. It does not explicitly name alternatives or say when not to use it, but the sibling context makes the distinction clear.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden for behavioral disclosure. It explicitly states 'Read-only,' which is the most important safety trait for this tool. It does not mention pagination, required IAM permissions, or response shape, but for a simple list operation the core behavior is adequately conveyed.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is three short sentences with no filler. It front-loads the action, then adds the use-case and the read-only trait. Every sentence earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple list operation with zero required parameters and rich schema coverage, the description gives sufficient context: what it lists, why it's useful, and its safety profile. It does not describe the exact return fields, but no output schema exists and the phrase 'List all accounts' makes the general return type clear.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, and the schema already documents both 'region' and 'provider' with defaults and provider-specific guidance. The description adds no additional parameter semantics, so the baseline score of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource: 'List all accounts in the AWS Organization.' It is clearly distinct from sibling tools like list_modules or list_groups, and the use-case sentence reinforces its role. It does not explicitly name an alternative, so it falls just short of full sibling differentiation.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The sentence 'Useful for discovering accounts before multi-account scanning' gives a clear context for when to invoke the tool. It does not explicitly mention when not to use it or name alternatives, but the use-case is specific enough to guide selection.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Explicitly states it does not modify AWS resources, a key safety trait. Lacks details on overwrite behavior, permissions, or confirmation response.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Two efficient sentences with zero fluff. Front-loaded with verb and resource.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

No output schema, so description should clarify return value. Missing error conditions and prerequisites. Adequate but not fully complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema descriptions cover 100% of parameters. Description adds context about ai_summary coming from get_ai_summary_prompt and its effect on dashboard Overview, exceeding schema info.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

Clearly states verb 'saves', resource 'scan results', and destinations 'local disk or S3'. Distinguishes from sibling scanning and reporting tools by being a persistence action.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Implies usage for dashboard display but does not explicitly contrast with sibling tools like generate_report or scan_and_report. No when-not-to-use guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure. It states 'Read-only' and 'Does not modify any AWS resources,' which covers safety expectations. However, it does not disclose output format, whether it scans a single region or all regions, or any other behavioral details beyond read-only safety.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is brief and front-loaded with the main action. The sentence 'Read-only' and 'Does not modify any AWS resources' are somewhat redundant, but the overall structure is efficient and free of filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a read-only scanner with two optional parameters fully described in the schema, the description is mostly adequate. However, with no output schema, the description does not clarify what the scanner produces or how results are presented, leaving a notable gap for a tool that returns findings.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the input schema already documents region and provider with clear descriptions, including Huawei Cloud specifics. The description itself adds no additional parameter meaning, so the baseline of 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb with resource ('Run Access Analyzer Findings security scanner') and scopes it with 'only,' distinguishing it from the many sibling scanner tools. It clearly identifies what the tool does, although it could further explain what Access Analyzer Findings are.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

No explicit guidance is given about when to use this tool versus alternatives like scan_security_hub_findings, scan_guardduty_findings, or scan_all. 'Only' implies a narrow scope, but the description does not name alternatives or provide conditions for selection, leaving usage largely to inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the burden of behavioral disclosure. It explicitly adds 'Read-only. Does not modify any AWS resources' and notes parallel execution and multi-account org scanning, which are useful behavioral facts not present in the schema.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is short, front-loaded, and every sentence carries useful information: scope, parallelism, safety, and org-mode support. There is no padding or repetition.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description gives a solid high-level picture: complete for invocation, but since there is no output schema and no annotations, it does not explain what the tool returns or how it relates to scan_and_report. It is adequate but not fully comprehensive for agent decision-making.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents all six parameters. The description adds no parameter-specific semantic detail beyond schema, matching the baseline expectation.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a clear action and scope: 'Run all security scanners in parallel (including service detection).' 'All scanners' distinguishes it from the individual scanner siblings at a glance, though it does not explicitly contrast it with scan_and_report.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies when to use this tool by emphasizing broad coverage ('all security scanners') and multi-account support, but it does not state explicit when/how alternatives like scan_and_report, scan_group, or individual scanners should be used instead.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description must carry the full burden. It does disclose an important side effect: reports are saved to ~/.aws-security/reports/. However, it does not mention operational behaviors such as required credentials, runtime, cost implications, or the exact scope of 'full security scan'.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Three short sentences with no filler: the main action is front-loaded, the benefit is stated second, and the output location is given last. Every sentence earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with 8 optional parameters and no output schema, the description gives the core purpose and output location but leaves ambiguity about what 'full security scan' includes and what operational caveats apply. The schema fills parameter details, but behavioral context remains thin.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema fully documents all 8 parameters. The description adds no parameter-level meaning, but the baseline of 3 applies because the schema carries the load.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific combined action: 'Run a full security scan AND generate reports in one step.' It also adds a distinguishing rationale ('Avoids large data transfer between tools') that separates it from the single-purpose scan_* and generate_* siblings.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies when to use this tool: when both scanning and report generation are needed, because it avoids the data transfer cost of chaining separate tools. It does not explicitly name alternatives or exclusions, but the context is clear enough.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure. It explicitly states 'Read-only' and 'Does not modify any AWS resources,' which tells the agent this tool is safe and non-destructive. It does not mention side effects like API costs or result output behavior, but the core safety trait is clearly disclosed.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is short and front-loaded with the core purpose, which is good. However, 'Read-only' and 'Does not modify any AWS resources' are redundant statements that could be condensed into one, so not every sentence earns its place fully.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers the tool's scope and safety profile, and the schema handles the two optional parameters well. However, there is no indication of what the output or findings look like, and no guidance on how to choose this scanner over the many closely related sibling tools.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the baseline is 3 even without additional parameter explanations in the description. The schema already documents region defaults and the huaweicloud provider behavior in detail. The tool description adds no parameter-specific meaning beyond the tool's overall scope.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly identifies the tool as running the Config Rules Findings security scanner, which distinguishes it from the many sibling scanner tools such as scan_guardduty_findings. The word 'only' narrows the scope, and 'Read-only' reinforces what the tool does.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The phrase 'Config Rules Findings security scanner only' implies the tool should be used when Config Rules findings are the target, but it does not explicitly state when to prefer this over scan_security_hub_findings, scan_guardduty_findings, or other scanners. No exclusions, prerequisites, or alternative tool routing are provided.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure. It explicitly states 'Read-only' and 'Does not modify any AWS resources,' which is critical for an agent to understand the tool's safety profile. This adds meaningful context beyond the schema, though it does not mention other behaviors like error handling or output format. The explicit read-only declaration is a strong positive.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two short sentences, efficient and to the point. The primary purpose is front-loaded, and the read-only caveat follows immediately. There is no unnecessary fluff or repetition, making it highly concise while still covering essential behavioral information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple scanner with two optional parameters and no output schema, the description covers the core purpose and the most important behavioral trait (read-only). The parameter details are fully documented in the schema, and no nested objects or complex return structures exist. It could benefit from a brief note on what the scan actually assesses (e.g., DR readiness indicators), but given the tool's simplicity, the completeness is adequate.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, with both parameters (region and provider) having detailed descriptions in the schema. The description does not add any additional parameter-specific information, such as examples or constraints beyond what the schema already provides. Thus, it meets the baseline of 3 but does not exceed it.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states a specific verb ('Run') and resource ('Disaster Recovery security scanner'), making it obvious that this tool is dedicated to DR security scanning. The word 'only' further narrows its scope, distinguishing it from sibling scan tools like scan_all or scan_secret_exposure. However, it does not explicitly enumerate what the scanner checks (e.g., backup, replication), so it stops short of full differentiation from other scanning tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage for disaster recovery security scanning but does not provide explicit when-to-use or when-not-to-use guidance. There is no mention of alternatives or conditions for selecting this tool over others. The context signals show many sibling scanning tools, and without guidance an agent might need to infer when this is the right choice. It is clear but not explicitly prescriptive.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure. It explicitly states 'Read-only' and 'Does not modify any AWS resources,' which covers the most critical safety behavior. However, it does not mention return format, permission requirements, or that the provider parameter can target Huawei Cloud, which is a notable omission for a tool with cross-provider support.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description consists of three short, front-loaded sentences: the purpose, the read-only nature, and no modification guarantee. Every sentence adds distinct value with zero fluff. This is an efficient, well-structured description.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a read-only scanner with two optional parameters and no output schema, the description adequately covers the primary purpose and safety profile. It does not mention provider support in the text, but the schema fully covers that, and no output format expectations are stated. Minor gaps are the lack of return-value hints and the AWS-specific language that might confuse when provider=huaweicloud, but overall this is reasonably complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema already has 100% description coverage for both parameters, including detail on the provider enum and Huawei Cloud behavior. The tool description adds no additional parameter-level meaning, so the baseline score of 3 applies. The description's reference to 'AWS resources' is slightly less general than the schema's provider parameter, which supports huaweicloud as well.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb ('Run'), a clear resource ('Dangling DNS security scanner'), and the word 'only' distinguishes it from sibling scanner tools. An agent can immediately tell this is a targeted scan for dangling DNS rather than a general scan tool. This effectively differentiates it from the many other scan_* siblings.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage context ('Dangling DNS security scanner only') but does not explicitly state when to use this versus alternatives like scan_all or other scan_* tools. There is no mention of prerequisites, exclusions, or a preferred workflow. This leaves the agent to infer the appropriate selection from the name and sibling context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It discloses that the tool is read-only, that it performs deep scanning of image layers, that it reports classifications against official scan results, and that it can skip images based on size limits. It doesn't disclose rate limits, NVD API behavior beyond the parameter description, or what happens to partial results, but the core behavioral traits are clearly stated.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is three sentences with zero waste. The core purpose and differentiator are front-loaded, the classification output is stated, and the read-only nature is appended. Every sentence earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a complex 14-parameter scan tool with no output schema, the description is reasonably complete: it states the purpose, the classification output, and the read-only nature. It doesn't describe the report structure or how results are returned, but the parameter descriptions cover the behavioral knobs. The lack of an output schema is a gap, but the description does enough to let an agent invoke the tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents all 14 parameters thoroughly. The description adds context about the overall scan behavior (deep-scan, classification) but doesn't add much per-parameter meaning beyond what the schema provides. Baseline 3 is appropriate because the schema does the heavy lifting.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb ('Deep-scan'), a specific resource ('ECR image layers'), and a specific scope ('critical/high CVEs missed by ECR Basic/Inspector Enhanced scanning'). It also names the classification output ('gap/confirmed/reverse-gap') and explicitly says 'Read-only', which distinguishes it from other scan tools. This is a clear, differentiated purpose statement.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies when to use this tool: when you need deeper CVE detection beyond ECR Basic/Inspector Enhanced, specifically for unmanaged binaries and distro secdb gaps. It doesn't explicitly name sibling alternatives or state when not to use it, but the contrast with 'ECR Basic/Inspector Enhanced scanning' provides clear context. The 'Read-only' note also helps an agent choose it over mutation tools.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full behavioral burden. It explicitly discloses 'Read-only' and 'Supports multi-account org scanning,' which are valuable safety and scope traits, but it does not describe result handling, runtime expectations, or any other side effects beyond being read-only.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact and front-loaded: it states the action, the resource, a scenario example, the read-only safety property, and the multi-account capability in three short sentences. Every sentence earns its place with no filler or redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 7-parameter tool with no output schema, the description is adequate but incomplete. The schema covers all parameter semantics, and the description names the scenario-based use case, but it does not mention how to discover available groups or what the tool returns after execution, which matters given the absence of an output schema.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, and the individual parameters already include rich semantics such as defaults, enum values, Huawei Cloud region behavior, and role assumption behavior. The tool description adds no additional parameter-level meaning beyond what the schema already provides, so the baseline of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb ('Run' and resource ('a predefined group of security scanners for a specific scenario'), with concrete examples like MLPS compliance and network defense. It is clearly distinct from the individual scan_* siblings, though it does not explicitly differentiate itself from scan_all or scan_and_report.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives clear context: use this tool when you need a scenario-based group of scanners rather than a single focused scanner. It also notes multi-account org scanning support, which signals a key selection factor, but it does not explicitly state when to prefer scan_all or scan_and_report instead.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Without any annotations, the description carries the full behavioral burden and it does disclose a key trait: the operation is read-only and does not modify AWS resources. This is essential side-effect communication for an agent deciding whether a scanner is safe to invoke. It omits other potential behavior details like runtime or API cost, but for a simple scanner, the non-destructive guarantee is the most important disclosure.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is only two short sentences with the action and target front-loaded. 'Does not modify any AWS resources' is slightly redundant with 'Read-only,' but the overall text is efficient and respects the reader's attention.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a low-complexity tool with fully documented optional parameters, the description covers scope and safety adequately. However, since there is no output schema, the description does not explain what the scanner returns or what happens when it runs, which an agent may need to anticipate. It also leaves the decision of when to select GuardDuty over sibling scanners entirely unaddressed.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema already provides 100% coverage for both optional parameters, including detailed region defaults and Huawei Cloud behavior. The description text itself adds no parameter-level semantics, so the baseline of 3 applies; no deduction is needed because the schema fully compensates.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource: 'Run GuardDuty Findings security scanner only.' The word 'only' explicitly limits the tool to this one scanner, distinguishing it from sibling tools such as scan_security_hub_findings or scan_inspector_findings. There is no ambiguity about the target resource.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives no guidance on when to use this tool versus the many similar scan tools in the sibling list. It does not mention Security Hub, Inspector, Trusted Advisor, Access Analyzer, or other finding sources, nor does it specify any condition that would make GuardDuty the correct choice. The 'only' clause is a scope limiter, not a usage rule.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It explicitly discloses 'Read-only' and 'Does not modify any AWS resources', which are key behavioral traits for a security scanner. It could add more (e.g., permissions, result format), but the core safety guarantee is transparent.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short sentences front-load the purpose and the read-only guarantee. There is no wasted wording; every sentence is functional.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a read-only scanner with two optional, well-documented parameters and no output schema, the description provides sufficient core context. It could mention relationships to sibling scanners, but the purpose and safety behavior are clearly covered.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, and both parameters (region, provider) have detailed descriptions in the schema. The main tool description adds no parameter-level meaning, so the baseline of 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb ('Run'), a specific resource ('IAM Privilege Escalation security scanner'), and adds 'only' to narrow scope. It is clear and unambiguous, but it does not explicitly name or contrast sibling tools, so it stops short of full sibling differentiation.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Use is implied: run this when you want IAM privilege escalation scanning. The word 'only' hints it is not for other scan types, but it does not name alternatives like scan_all or scan_and_report, nor give explicit conditions or exclusions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure. It explicitly states 'Read-only. Does not modify any AWS resources,' which is critical safety information for an agent. It could add more detail about side effects or output, but the key non-mutating behavior is clearly disclosed.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is three short sentences with no filler: purpose, scope, and safety. Every sentence contributes important information, and the key qualifier 'only' is front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a low-complexity tool with zero required parameters and 100% schema coverage, the description is mostly adequate. However, with no output schema, it does not mention what the scan returns or how results are presented, and it does not relate this tool to the broader scan_all/scan_group workflow. These are meaningful gaps for an agent deciding how to use the result.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, and both parameters already have meaningful descriptions in the schema. The tool description adds no additional parameter-level semantics, so the schema carries the load. This meets the baseline for high schema coverage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource: 'Run Idle Resources security scanner only.' This clearly identifies what the tool does and distinguishes it from the many sibling scanning tools by narrowing the scope to idle resources. The read-only note reinforces the purpose.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives no guidance about when to use this tool versus alternatives like scan_all, scan_group, or the other scan_* tools. It only says 'only,' which hints at scope but does not explain when an agent should choose this tool or when it should not.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure. It clearly states 'Read-only. Does not modify any AWS resources,' which is valuable safety information for an agent. It also discloses the huaweicloud fallback behavior ('org_mode falls back to the current account with a warning') in the parameter description, which is a meaningful behavioral trait beyond a simple scan.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences with zero waste. The core purpose and safety guarantee are front-loaded, and the provider-specific nuance is placed in the parameter description where it belongs. Every sentence earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a read-only scanner with no required parameters and no output schema, the description is nearly complete. It covers purpose, safety, and provider-specific behavior. The only minor gap is that it does not describe what the scan returns or how results are delivered, but with no output schema and a simple read-only operation, this is a small omission.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents both parameters. The description adds value by explaining the huaweicloud provider's region semantics (Huawei Cloud region ID, 'all' to scan every region project, single-account fallback), which goes beyond the bare schema enum. This compensates for the schema's minimal region description.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb ('Run'), a specific resource ('IMDSv2 Enforcement security scanner'), and explicitly scopes it as read-only. It distinguishes itself from the many sibling scan tools by naming the exact scanner, so an agent can tell it apart from scan_iam_privilege_escalation or scan_public_access_verify without opening schemas.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage context by naming the scanner and noting it is read-only, but it does not explicitly state when to choose this tool over alternatives like scan_all or scan_group. It provides no exclusions or conditions (e.g., 'use this when you only need IMDSv2 enforcement'). The sibling list is large, and the description does not route the agent to a broader alternative.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are present, so the description carries the burden of behavioral disclosure. It does state 'Read-only. Does not modify any AWS resources,' which is an important safety trait for a scanner. However, it does not mention required permissions, return/output behavior, or any other operational side effects beyond non-modification.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short sentences with no filler, front-loading the key 'only' scope and then adding the read-only safety note. Every sentence earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a two-optional-parameter, read-only scanner, the description covers the core operation and safety profile, and the schema covers parameters. Still, with no output schema and no annotation enrichment, the description does not indicate what the caller should expect back after running the scan, leaving a clear but minor completeness gap.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema already documents both parameters with 100% coverage, including a detailed description of the provider enum and Huawei Cloud behavior. The description adds no parameter-level information, so the schema-based baseline of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description states the tool's job with a specific verb and resource: 'Run Inspector Findings security scanner only.' The 'only' phrasing clarifies that this is not a general scanner, though it does not explicitly name sibling tools such as scan_security_hub_findings. It is clear enough to identify the tool's purpose at a glance.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description conveys the usage context: run only the Inspector Findings scanner, and it is read-only, so an agent can infer when it applies. It does not explicitly state when not to use it or name alternatives among the many scanner siblings, leaving some routing to inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure. It explicitly states 'Read-only' and 'Does not modify any AWS resources', which is a key safety-relevant behavior. This is genuinely useful information an agent otherwise could not infer from the schema.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is short and front-loaded, with no wasted words. Minor redundancy exists between 'Read-only' and 'Does not modify any AWS resources', but the overall structure is efficient and easy to parse.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a two-parameter tool with fully documented parameters, the description covers purpose and non-destructive behavior. However, it does not describe the output of the scan or provide usage guidance relative to the large sibling set, so it is adequate but not complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%: both region and provider are already documented, including details like AWS vs Huawei Cloud region IDs and fallback behavior. The description adds no parameter-level meaning beyond what the schema provides, so the baseline of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb and resource ('Run Network Reachability security scanner only'), making the tool's purpose clear. It is distinguishable from the many scan_* siblings by name and the qualifier 'only', though it does not explicitly reference an alternative.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The phrase 'security scanner only' and 'Read-only' give an implied use context, but there is no explicit guidance about when to choose this scanner over siblings like scan_all, scan_and_report, or the other scan_* tools. It does not state when not to use it.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full safety burden, and it explicitly states 'Read-only. Does not modify any AWS resources.' This is a crucial behavioral disclosure for a scanner that could otherwise be assumed to take remediation actions. It does not describe return/output behavior, but the read-only/no-modification claim covers the main side-effect risk.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Three short declarative sentences, front-loaded with the action and scope, with no filler. Each sentence adds a distinct constraint: what to run, that it is read-only, and that it does not touch AWS resources. This is very efficient.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a low-complexity scanner with two fully documented optional parameters, the description is mostly sufficient: purpose and safety are clear. However, there is no description of what the tool returns, and the no-modification statement only mentions AWS resources even though the provider enum includes Huawei Cloud. These are minor but real gaps.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema already documents both parameters at 100% coverage, so the description does not need to repeat them. The description adds no parameter-level semantics, but the enum, defaults, and provider/region interaction are already in the schema. Baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

'Run Patch Compliance Findings security scanner only' gives a concrete verb, a specific scan target, and an explicit scope restriction. It is immediately clear this is a single-purpose findings scanner among the scan_* siblings. It does not name an alternative, but the resource and 'only' are sufficient.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The phrase 'scanner only' and 'Read-only' imply this tool should be used for the isolated patch-compliance scan rather than broader scan/report flows. However, it names no sibling alternatives and gives no explicit conditions for choosing this over scan_all, scan_and_report, or the other findings scanners. Usage guidance is implied, not explicit.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure. It explicitly states 'Read-only' and 'Does not modify any AWS resources,' which is valuable safety-relevant context for a scanner tool. It does not disclose auth requirements or output behavior, but for a safe read-only scan this is reasonable.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two short sentences with no filler. The primary purpose is front-loaded immediately, and the safety clarification follows without redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with only two optional parameters and full schema coverage, the description is mostly sufficient. It states the tool's scope and safety profile, though it does not mention what the scan returns or how it relates to grouped scan workflows. Given the low complexity, this is a minor gap.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, with both region and provider already well documented, including the huaweicloud nuance. The description itself adds no parameter-level information, so the baseline score of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description gives a specific verb ('Run'), a specific resource ('Public Access Verify security scanner'), and narrows scope with 'only', which clearly distinguishes it from the combined or report-generating siblings like scan_and_report and scan_all.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The word 'only' implies this tool should not be used for broader scans or other scanner types, but the description does not explicitly state when to choose this versus alternatives such as scan_all or scan_group. Usage context is weakly implied rather than clearly specified.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the behavioral burden and does disclose the key safety trait: the operation is read-only and does not modify AWS resources. It doesn't mention auth, rate limits, or return behavior, but for a read-only scanner these are less critical, and the 'security scanner only' phrasing signals no remediation side effects.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is very short and front-loads the main action in the first sentence. There is some redundancy between 'Read-only' and 'Does not modify any AWS resources', and 'security scanner only' partly restates the name, but overall it is compact and scannable.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple tool with two optional parameters and a fully documented schema, the description plus schema is mostly adequate. The main gaps are the lack of output/return information and the absence of usage context relative to sibling scanners, though 'security scanner' and the tool name partially compensate.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% and the parameter descriptions already explain region, provider defaults, Huawei Cloud region IDs, and the single-account fallback. The tool description adds no parameter-level meaning, so it stays at the baseline for fully documented schemas.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly identifies the action (run) and resource (RMS Compliance Findings, Huawei Cloud security scanner), and the 'only' wording hints it is a focused single-scanner operation. It doesn't explain what the scanner produces or explicitly differentiate it from sibling scan_*_findings tools, though the name itself already provides that differentiation.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is provided about when to choose this tool over alternatives like scan_all or scan_security_hub_findings, nor are exclusions or prerequisites mentioned. The word 'only' implies it is not a catch-all scan, but this is too indirect to be actionable.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description takes on the safety disclosure burden. It clearly states the operation is read-only and does not modify AWS resources, which is the key behavioral concern for a scanner. More detail about side effects such as required permissions or runtime would improve it, but the essential behavior is disclosed.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is short and front-loaded, stating the operation in the first sentence. 'Read-only' and 'Does not modify any AWS resources' are somewhat redundant, but the text remains compact and scannable.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a low-complexity tool with two fully documented optional parameters and no output schema, the description plus schema cover the needed context: purpose, scope, provider options, and read-only safety. It could add explicit usage boundaries or return expectations, but nothing critical is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents both region and provider thoroughly, including huaweicloud-specific behavior. The description adds no parameter-level meaning, which is acceptable at baseline but not above it.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a clear action ('Run') and a specific target ('Secret Exposure security scanner'), so the purpose is unambiguous. The word 'only' hints that this tool is scoped to secret-exposure scanning rather than other security checks, but it does not explicitly contrast with sibling scanners.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The phrase '...scanner only' implies this tool is for secret-exposure scanning and not for other scan types, but no explicit when-to-use or alternative sibling tools are mentioned. An agent must infer usage from the tool name and the word 'only'.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden and explicitly states 'Read-only. Does not modify any AWS resources.' This clearly discloses the most important behavioral trait (safety). It does not cover other behaviors like output format or permissions, but the read-only guarantee is strong.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences with no filler. The purpose is front-loaded and the safety note is a valuable second sentence. Every word earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers purpose and safety, but with no output schema and many siblings like save_results and generate_report, it leaves unclear what the scan produces or whether results are returned or saved. For a tool with optional parameters and no annotations, this is a moderate gap.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% and both parameters are described in the schema, including the Huawei Cloud provider behavior. The description adds no parameter-level detail beyond the schema, so the baseline of 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific action ('Run Security Hub Findings security scanner only') with a clear resource and scope. The word 'only' distinguishes it from broader scanners like scan_all and other findings scanners like scan_guardduty_findings.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is given on when to use this tool versus alternatives. The sibling list includes many overlapping scanners (GuardDuty, Inspector, Trusted Advisor), and the description does not mention how this scanner differs or when to choose it over scan_all or scan_group.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the behavioral burden, and it explicitly states 'Read-only' and 'Does not modify any AWS resources.' It does not cover permission needs, rate limits, or output behavior, but the core side-effect profile is transparent.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is short and front-loaded, with the core purpose in the first sentence. 'Read-only' and 'Does not modify any AWS resources' are mildly redundant, but overall the description is appropriately compact.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers purpose and side-effect safety, and the schema fully handles parameters. However, it does not mention expected return/output behavior and gives no context about how this scanner relates to broader scan workflows, leaving minor gaps for an agent deciding how to use it.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents region and provider, including the huaweicloud nuance. The description adds no parameter-level meaning beyond what the schema provides, so the baseline of 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a specific verb and resource — 'Run SSL Certificate security scanner only' — making the tool's focus clear. The word 'only' also separates it from the broader scan_all/scan_and_report siblings, though no sibling is explicitly named.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is given about when to use this scanner versus the many sibling scan tools, or when a broader scan would be more appropriate. The 'only' wording implies exclusivity but does not explain how to choose between alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the behavioral burden and does disclose a key safety trait: 'Read-only. Does not modify any AWS resources.' However, it does not mention other behavioral aspects such as required permissions, whether findings are returned inline, or whether provider-specific behavior differs beyond what the schema already states.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is three short sentences with no filler. The primary purpose is front-loaded, and every phrase adds distinct value: what it runs, that it is read-only, and that it does not modify resources.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple scanner with only optional parameters and a fully documented schema, the description covers the read-only safety aspect. But with no output schema and no annotation support, it leaves the return behavior and operational context (e.g., what compliance findings look like, when this scanner is relevant) to inference.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the input schema fully documents both parameters, including the huaweicloud provider nuances. The description adds no parameter-level information, so the baseline score of 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb-resource pair: 'Run Tag Compliance security scanner' and reinforces scope with 'only'. It clearly distinguishes this from the many sibling scan tools by naming the exact scanner type.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is given on when to choose this tool over alternatives such as scan_public_access_verify, scan_idle_resources, or scan_security_hub_findings. The word 'only' is a scope qualifier, not a usage guideline, and no when/when-not conditions or alternative tool names are mentioned.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Since no annotations are provided, the description carries the full burden of disclosing side effects. It explicitly states 'Read-only' and 'Does not modify any AWS resources,' which is the most critical behavioral trait for a scanner. It does not cover permission needs or output behavior, but the safety profile is clearly disclosed.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short sentences with no filler. The tool's purpose and key safety property are front-loaded, and every word earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers the core purpose and side effects, and the schema covers parameters. However, with no output schema and no usage guidance among many similar scan tools, the overall context is only minimally adequate for an agent to confidently select and invoke the tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema already documents both parameters fully, with 100% coverage including defaults and enum behavior. The description adds no parameter-level meaning beyond that, so the baseline of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly identifies the action ('Run ... security scanner'), the specific resource (Trusted Advisor Findings), and emphasizes that it is 'only' this scanner. The resource name itself distinguishes it from sibling scan tools, though it does not explicitly contrast with them.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

No when-to-use guidance is provided. With many sibling scan_* tools, the description gives no explicit indication of when Trusted Advisor Findings should be chosen over Security Hub, GuardDuty, Inspector, or others. 'Only' communicates scope, not selection criteria.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the burden of disclosing side effects. It explicitly states 'Read-only' and 'Does not modify any AWS resources,' which directly reassures an agent about safety. However, it does not mention other behavioral aspects like output format or whether it makes network calls, though the read-only guarantee is the most critical trait.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is three short sentences, each carrying useful information: the action, the read-only nature, and the no-modification guarantee. It is front-loaded with the core purpose and wastes no words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with two optional parameters and no output schema, the description is minimally adequate: it states what it does and that it is safe. However, it does not indicate what the scanner returns, how the results are presented, or any prerequisites such as AWS credentials or permissions. These gaps leave an agent guessing about the tool's full behavior.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema fully documents both parameters (region, provider) including the enum and provider-specific behavior. The description adds no additional parameter semantics beyond what the schema provides, so the baseline of 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource: 'Run WAF Coverage security scanner only.' The word 'only' clearly distinguishes it from broader scanners like scan_all and the other scan_* siblings. This makes the tool's scope unmistakable even without opening the schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage for WAF coverage scanning through the explicit 'only' phrasing, but it never explicitly states when to choose this tool over alternatives such as scan_all or scan_security_hub_findings. There is no mention of exclusions or conditions that would route an agent to a sibling tool.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.