authorize_docker_session

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Even with destructiveHint=true and readOnlyHint=false, the description adds substantial detail: it stores only process-local authorization, does not execute or profile the target, requires a fresh user reply, and clarifies that MCP permission is not workload consent. It also explains the consequence of needing expanded modes—a new summary and fresh authorization. No contradiction with annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Four sentences, each carrying necessary compliance detail. The purpose is front-loaded in the first sentence; the remaining sentences cover critical behavioral and consent constraints without excess verbiage. Slightly dense but well-structured for a security-sensitive operation.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers the essential consent workflow, mode constraints, and non-execution guarantee. An output schema exists, so return values are not the description's burden. However, it does not explicitly differentiate this from sibling authorization tools like authorize_docker_optimization_session or authorize_managed_docker_session, which could leave an agent uncertain which authorization path applies.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate. It adds important semantics for allowed_modes (must exactly equal summary mode set, expansion requires new authorization) and for authorization (user consent phrase, not just MCP permission). However, it leaves host_pid, container_pid, container_reference, and authorization_mode completely unexplained by description, relying on their names alone.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The first sentence states a specific action ('Authorize'), a specific resource ('one project-bound existing-container performance session'), and the scope ('project-bound', 'existing-container'). It also distinguishes itself from execution/profile tools by explicitly stating it 'does not execute or profile the target', making it clear this is only an authorization step.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides critical usage conditions: a fresh user reply to the exact session summary is required, MCP permission is not workload consent, and allowed_modes must exactly match the summary. It does not explicitly name sibling authorization tools (e.g., authorize_docker_optimization_session) as alternatives, but the context of 'project-bound existing-container performance session' gives clear situational discrimination.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.