Scan Mcp Config

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already establish readOnlyHint=true and openWorldHint=false, and the description adds genuinely new behavioral context: input must be pasted text, never a filesystem path; no config values are echoed into the report; findings are indicators not verdicts; an empty report is not proof of safety. The one gap is that the schema's 256 KiB limit is left to the schema rather than reinforced, but the safety and privacy semantics are unusually well disclosed for a read-only tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with the purpose, then explicitly labeled sections for when to use and when to prefer alternatives, then caveats. Every sentence carries information, though the multi-line wrapping mid-sentence makes it slightly harder to scan than it could be.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists so return-value explanation is not required, yet the description still explains the coverage field and its skip reasons, which is the part an agent needs to interpret results honestly. Combined with the caveat that findings are indicators, nothing needed to call this correctly is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% and there is only one parameter, so the schema does most of the work. The description still adds meaningful meaning by clarifying that config_text is pasted config content rather than a path, which is the most likely misuse of a single string argument.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb ('Check') and resource ('an MCP client config'), names the client families covered, and enumerates the seven check categories (CF001-CF007) plus what they target (unpinned runners, plain-http remotes, hardcoded secrets). An agent can distinguish this from every sibling without opening a schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides explicit 'Use when' guidance (reviewing a config the user has or is about to copy) and explicit 'Prefer another tool when' routing to scan_tool_definitions and audit_package with the exact conditions that select them. Both inclusion and exclusion criteria are stated.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.