HTTP/API probe

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare openWorldHint=true and destructiveHint=true, so the agent knows this touches external state. The description adds one genuinely new behavioral fact — resolved secret values never appear in output — which meaningfully affects how the agent can use results. However, it never warns that DELETE/POST/PUT can mutate remote resources, nor describes retry/backoff semantics or what a failed assertion yields.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, front-loaded with the core action and no filler. Length is appropriate, though the second sentence (secret-leak guarantee) is arguably the only content-bearing clause and the rest is terse to the point of under-specification.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

A 15-parameter tool with nested objects, 0% schema descriptions, no output schema, and destructive semantics gets only two sentences. The agent has no way to learn what success/failure looks like, what assertions do on mismatch, or how retry interacts with assertions — substantial gaps for a tool of this complexity.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0% across 15 parameters, so the description must compensate and largely does not. It gestures at authorization.secretRef, assertions, and maxAttempts/intervalMs, but leaves body vs jsonBody, deviceId/deviceName, redirect, maxResponseBytes, and the ambiguous pair timeoutMs vs requestTimeoutMs entirely unexplained.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

States a concrete verb and resource ("Call an HTTP endpoint") plus three distinguishing capabilities: secret references, assertions, bounded retry. No sibling tool in the list does HTTP probing, so the agent can place it easily. It stops short of saying what class of task it is for (API smoke tests, health checks), but the core is unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no guidance on when to use this rather than shell_run (curl), wait_until, or the dev_pipeline_* tools — both plausible substitutes for endpoint checks. The phrase "structured assertions and bounded retry" implies a verification use case, but no exclusions or prerequisites are stated.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.