pentest_burp_api

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations supplied, the description carries the full burden, and it does disclose two real constraints: methods are limited to GET/POST, and requests are confined to the configured base URL. It says nothing about authentication expectations, what happens on a non-2xx response, or the side effects a POST to Burp can trigger (starting scans, modifying config) — a notable gap for a tool that can mutate state.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

A single well-formed sentence with the scope limit and method restriction packed in early and no filler. Nothing can be trimmed without losing a constraint.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Scored relative to a deliberately generic passthrough tool: it establishes the channel, the permitted verbs, and the URL boundary, which is the information needed to call it safely. Return values are implicitly the raw Burp response and, with no output schema, the agent is not missing a documented contract that was promised elsewhere.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must supply the meaning, and it does constrain 'method' to GET/POST and frames 'path' as relative to the configured base URL. The 'body' parameter is never mentioned, and path syntax (leading slash, query strings) remains undefined.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific mechanism (GET/POST passthrough) against a named resource (the Burp REST API) bounded by a configured base URL. An agent can distinguish it from the focused siblings pentest_burp_import and pentest_burp_status, which do fixed operations rather than arbitrary calls. It stops short of naming those siblings explicitly as alternatives.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The word 'passthrough' implies this is the escape hatch for Burp endpoints not wrapped by a dedicated tool, but that inference is left to the agent. There is no statement of when to prefer this over pentest_burp_import or pentest_burp_status, and no prerequisites are given.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.