openwisp_obtain_token

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full behavioral burden. It usefully discloses the credential type and the underlying HTTP POST endpoint, but omits token lifetime/expiry, error behavior on bad credentials, and any rate-limit or side-effect notes.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Two compact clauses with the key action front-loaded after the category tag. No waste, though the bracketed category prefix is metadata rather than tool guidance.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a two-param, no-output-schema auth tool the description is adequate: it conveys the caller supplies credentials and receives a bearer token. Still missing are the essentials an agent would want, such as token validity window and whether the token is required for other calls.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% and both parameters are documented in the schema itself. The description adds nothing beyond restating that username and password are the inputs, so the baseline of 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb+resource ("Obtain an API bearer token") so the agent can distinguish it from the CRUD siblings immediately. It also names the credential source, making intent unmistakable, though it doesn't explicitly contrast itself with sibling auth-related tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is implied: this is the authentication step that produces a bearer token from username/password. However, it never states when to call it (e.g., before other API calls), whether tokens must be refreshed, or what happens on invalid credentials, so no explicit when/when-not guidance is given.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.