Server Quality Checklist

Tool Scores

• verify_secure_promptB
  3.4/5.0
  Behavior3/5

  Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

  With no annotations, the description carries the burden. It discloses the tool's read-only nature (verification) and output details (security scan results, risk level, status), which is helpful. However, it omits behavioral traits like error handling (e.g., invalid ID), performance (e.g., latency), or side effects (e.g., logging).

  Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

  Conciseness4/5

  Is the description appropriately sized, front-loaded, and free of redundancy?

  The description is concise (two sentences) and front-loaded with the core purpose. Every sentence adds value: the first defines the action, and the second specifies outputs. Minor improvement possible by integrating output details more seamlessly.

  Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

  Completeness3/5

  Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

  Given no annotations, no output schema, and a simple input schema, the description is adequate but incomplete. It covers the purpose and outputs but lacks details on error cases, response format, or integration with siblings. For a verification tool, more context on security implications would be beneficial.

  Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

  Parameters3/5

  Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

  Schema description coverage is 100%, with the parameter 'promptId' fully documented in the schema. The description adds no additional parameter semantics beyond what the schema provides, so it meets the baseline of 3 for high coverage.

  Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

  Purpose4/5

  Does the description clearly state what the tool does and how it differs from similar tools?

  The description clearly states the action ('verify') and resource ('existing secure prompt by its ID'), with specific outputs mentioned. It distinguishes from siblings like 'register_secure_prompt' (create) and 'audit_prompts' (likely batch analysis), but doesn't explicitly contrast with 'get_embed_code'.

  Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

  Usage Guidelines3/5

  Does the description explain when to use this tool, when not to, or what alternatives exist?

  Usage is implied by the description: use this tool when you have a prompt ID and need verification results. However, it lacks explicit guidance on when to choose this over alternatives like 'audit_prompts' or prerequisites (e.g., the prompt must already exist).

  Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

• get_embed_codeA
  3.5/5.0
  Behavior2/5

  Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

  With no annotations provided, the description carries the full burden of behavioral disclosure. It mentions that the tool 'generate[s]' code but doesn't describe what the output looks like (HTML vs React format details), whether there are rate limits, authentication requirements, or potential side effects. For a code generation tool with zero annotation coverage, this leaves significant behavioral questions unanswered.

  Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

  Conciseness5/5

  Is the description appropriately sized, front-loaded, and free of redundancy?

  The description is two sentences with zero waste. The first sentence states the core purpose, and the second provides usage guidance. Every word serves a clear function, and the information is front-loaded appropriately.

  Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

  Completeness3/5

  Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

  Given the tool's moderate complexity (code generation with one parameter) and lack of both annotations and output schema, the description is minimally adequate. It covers the basic purpose and usage sequence but doesn't address output format, error conditions, or integration details that would be helpful for a developer implementing this. The absence of output schema means the description should ideally explain what gets returned.

  Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

  Parameters3/5

  Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

  Schema description coverage is 100%, so the schema already documents the single 'promptId' parameter. The description adds marginal value by implying the prompt must be 'registered' first, which provides context for the parameter's purpose. However, it doesn't provide additional syntax, format, or validation details beyond what the schema provides, meeting the baseline for high schema coverage.

  Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

  Purpose4/5

  Does the description clearly state what the tool does and how it differs from similar tools?

  The description clearly states the tool's purpose: 'Generate HTML and React embed code for displaying a secure prompt badge.' It specifies both the action (generate code) and the resource (embed code for secure prompt badge). However, it doesn't explicitly differentiate from sibling tools like audit_prompts or verify_secure_prompt, which appear to serve different purposes.

  Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

  Usage Guidelines4/5

  Does the description explain when to use this tool, when not to, or what alternatives exist?

  The description provides clear context for when to use this tool: 'Use this after registering a prompt to get the code to add to your website.' This establishes a sequence (after registration) and a target use case (website integration). While it doesn't explicitly mention when NOT to use it or name alternatives, the guidance is specific enough for practical application.

  Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

• register_secure_promptA
  4/5.0
  Behavior4/5

  Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

  With no annotations provided, the description carries the full burden of behavioral disclosure. It effectively describes key behaviors: AI scanning for specific security threats (injection attacks, hidden instructions, etc.), domain verification functionality, and the return of multiple display options with implementation guidance. It also mentions the need for user interaction after registration. The only gap is lack of information about rate limits, authentication requirements, or error handling.

  Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

  Conciseness4/5

  Is the description appropriately sized, front-loaded, and free of redundancy?

  The description is appropriately sized and front-loaded with the core purpose in the first sentence. Each subsequent sentence adds valuable information about scanning capabilities, return values, and user interaction requirements. There's minimal redundancy, though the final sentence about implementationGuide could be slightly more concise.

  Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

  Completeness3/5

  Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

  Given the tool's complexity (security scanning with multiple outputs and user interaction requirements) and the absence of both annotations and an output schema, the description does a decent job but has gaps. It explains what the tool does and what it returns at a high level, but doesn't detail the structure of the response beyond mentioning 'implementationGuide field' or potential error cases. For a tool with no output schema, more detail about return values would be helpful.

  Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

  Parameters3/5

  Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

  Schema description coverage is 100%, so the schema already documents all three parameters thoroughly. The description doesn't add any additional meaning about the parameters beyond what's in the schema descriptions. It mentions domain verification context but doesn't elaborate on parameter usage beyond the schema's existing documentation.

  Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

  Purpose5/5

  Does the description clearly state what the tool does and how it differs from similar tools?

  The description clearly states the specific action ('register a prompt'), the resource ('HashBuilds Secure Prompts'), and the purpose ('for security verification and get embed options'). It distinguishes from siblings by focusing on registration and scanning rather than auditing existing prompts, retrieving embed code, or verification alone.

  Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

  Usage Guidelines4/5

  Does the description explain when to use this tool, when not to, or what alternatives exist?

  The description provides clear context for when to use this tool (to register and scan a prompt for security issues and get embed options). It mentions a specific follow-up action ('ASK THE USER which display option they prefer before implementing'), which implies usage guidance. However, it doesn't explicitly state when NOT to use it or name alternatives among sibling tools.

  Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

• audit_promptsA
  4.3/5.0
  Behavior4/5

  Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

  With no annotations provided, the description carries full burden and does well by explaining the tool's behavior: it categorizes prompts, presents audit results with three categories (user-facing, internal, needing manual review), and guides the user through a workflow. It doesn't mention rate limits or error handling, but covers core behavioral aspects adequately.

  Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

  Conciseness4/5

  Is the description appropriately sized, front-loaded, and free of redundancy?

  The description is appropriately sized and front-loaded with the purpose, followed by a detailed 'HOW TO USE' section. While slightly verbose, every sentence adds value by guiding the user through the workflow, making it efficient for its instructional purpose.

  Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

  Completeness4/5

  Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

  For a tool with no annotations and no output schema, the description provides comprehensive context: it explains the tool's role in a larger workflow, how to prepare inputs, what the tool does, and what to do with results. The main gap is the lack of output format details, but the workflow guidance compensates well.

  Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

  Parameters3/5

  Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

  Schema description coverage is 100%, so the schema already documents the 'prompts' parameter and its nested properties. The description adds context by explaining what the prompts array should contain ('prompts found in the codebase') and how to prepare it (via search patterns), but doesn't provide additional semantic details beyond the schema's thorough documentation.

  Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

  Purpose5/5

  Does the description clearly state what the tool does and how it differs from similar tools?

  The description clearly states the tool's purpose: 'Analyze a list of prompts found in a codebase and categorize them as user-facing (needs badge) or internal (audit only).' It specifies the verb ('analyze'), resource ('prompts'), and distinguishes from siblings by focusing on categorization rather than registration or verification.

  Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

  Usage Guidelines5/5

  Does the description explain when to use this tool, when not to, or what alternatives exist?

  The 'HOW TO USE' section provides explicit step-by-step guidance, including when to use this tool (after searching the codebase for prompts) and alternatives (e.g., 'Use register_secure_prompt for each selected prompt'). It clearly differentiates this audit tool from the registration sibling tool.

  Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.