Start Alza mobile API OAuth

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations only declare readOnlyHint=false, openWorldHint=true, idempotentHint=false, destructiveHint=false. The description adds substantial context those flags cannot carry: it creates only a local PKCE session, credentials never enter the MCP, nothing changes on Alza's side, the code is short-lived, and repeated calls invalidate the prior state (explaining the idempotentHint=false in practical terms). It also pre-empts a specific failure mode (the ~40 s 'Při přihlášení došlo k chybě.' client-side timer on desktop). No contradiction with annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Purpose and trigger are front-loaded, then the flow, then the footgun and the constraint against repeated calls. It is long, but nearly every sentence (DevTools workaround, Location header, short-lived code) is operationally necessary for a browser-based PKCE flow, so the length is largely earned rather than padding.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a complex, multi-step OAuth flow with a known platform footgun, the description covers trigger, mechanics, hand-off to auth_exchange, failure-signal interpretation, and safety. An output schema exists, yet the description still usefully names the two returned values, and nothing an agent needs to invoke this correctly is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Zero parameters, so the schema has no semantics to add; baseline for an empty schema is 4. The description compensates by explaining the returned state value and how it feeds into auth_exchange (code + state), which is the only 'parameter-like' information an agent needs.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Start an OAuth 2.0 PKCE sign-in for the Alza mobile API') and immediately distinguishes itself from the sibling auth tools by naming what it returns ('an authorization URL plus a state value') versus what auth_exchange does. An agent can route among auth_start/auth_discovery/auth_exchange without opening schemas.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives explicit trigger conditions ('Use when account_status reports no loaded token, or when account tools start failing with authentication errors') and names the follow-up tool ('call auth_exchange'). It also states a prohibition ('Do not call it repeatedly for one sign-in — each call supersedes the previous state'), which is a rare and useful when-not-to-use rule.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.