pentest_remediation_plan

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations supplied, the description carries the full burden. It does disclose a useful behavioral trait beyond the schema — the output is bucketed into three urgency tiers — but it omits whether the call is read-only vs. state-changing, what prerequisites exist (e.g. existing findings/engagement data), and whether output is deterministic.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

A single front-loaded sentence with no filler, and the three wave tiers are placed where an agent will read them first. It is telegraphic to the point of being a fragment, which slightly reduces clarity despite the density.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool is simple (no params, no nested objects, no annotations, no output schema), so low description volume is defensible. Still, an agent gets no signal about required prior state, whether the call has side effects, or what the returned plan structure looks like beyond the three tier names, leaving real gaps for a planning/reporting step in a pentest workflow.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool takes zero parameters, so there is no parameter meaning for the description to add; the baseline of 4 applies. The wave tiers are output-shaping language rather than arguments, and no call arguments are needed to invoke it correctly.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description names the resource (a remediation roadmap) and its organizing structure (immediate, short-term, scheduled waves), which is more specific than a restated title. However, there is no verb at all — it never says whether it generates, lists, or summarizes the plan, and it does not distinguish itself from nearby reporting/remediation siblings such as pentest_report or pentest_cvss.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no when-to-use guidance: nothing says to call it after findings are collected via pentest_add_finding, nor whether it should be used instead of pentest_report / pentest_report_html for remediation-oriented output. The usage is only inferable from the name and the wave vocabulary.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.