pentest_report_sarif

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full behavioral burden and does not state whether the export is a read-only operation, where the findings are sourced from, or whether it writes a file versus returning content. Naming the SARIF version is useful context, but permission, side-effect, and output-destination behavior are all left unstated.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

A single front-loaded sentence that identifies the format and target consumers with no filler. Its brevity is appropriate, though the saved words were not spent on the missing operational detail.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a one-parameter export tool with no output schema, the description covers what is produced but not how or where, and it omits any routing against the other report tools. An agent can guess the intent but must experiment with output_path to call it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema has one parameter, output_path, with 0% description coverage and a default of empty string, so the schema gives no semantics at all. The description never mentions output_path or what an empty default implies (e.g., return inline vs write to disk), leaving the single most important invocation decision undocumented.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (Export) and resource (findings) plus the concrete output format (SARIF 2.1.0), so the agent knows exactly what the tool produces. It does not distinguish itself from report siblings such as pentest_report_html or pentest_report_generic_json, which occupy adjacent format-selection space.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The phrase 'for security dashboards and code scanning' implies the downstream consumer and thus the use case, but there is no explicit when-to-use rule and no mention of the alternative report tools. The agent must infer that this is the choice for SARIF-consuming tooling rather than HTML or JSON output.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.