pentest_report_html

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It discloses report content (severity colouring, remediation notes) but omits that this writes a file to disk, whether an existing file is overwritten, where output goes when output_path is empty, and what source of findings is used.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

One tightly written sentence with the artifact front-loaded and no filler. It is arguably too terse rather than padded, but there is no wasted wording and no structural confusion.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a low-complexity, single-parameter tool with no output schema this is close to adequate: the agent knows it gets an HTML report on disk. Missing are the data source for findings and the meaning of the default output_path, both of which are absent from every structured field.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% for the single parameter output_path, and the description never mentions it. Critically, the parameter has an empty-string default, and the description does not say what happens then (stdout, default directory, or error), which is the one piece of meaning that must come from prose.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb and artifact ('Render a standalone HTML report') and names two content features (severity colouring, remediation notes), so the agent knows what it produces. It does not distinguish this from sibling report tools such as pentest_report, pentest_report_sarif, or pentest_report_generic_json, so sibling routing is left to inference.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no statement of when to choose HTML over SARIF, generic JSON, or the plain pentest_report tool, and no precondition such as requiring existing findings. The agent must guess based on tool names alone.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.