Whoami

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The readOnlyHint=true annotation matches the description's read-only framing. Beyond annotations, it discloses the underlying RFC 4532 'Who Am I?' extended operation and that it behaves correctly across SASL-GSSAPI and simple binds — real behavioral context an agent couldn't get from the annotation alone.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The core purpose is front-loaded in the first sentence and the follow-up is short and substantive. The inline `{"authzid": ...}` return shape is slightly redundant given an output schema exists, but it costs only a clause.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Return values are covered by the output schema, so the description needn't expand there, and the protocol-level behavior is well explained. The unexplained optional 'domain' parameter is the notable remaining hole in an otherwise adequate definition for a one-parameter diagnostic tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The single parameter 'domain' has 0% schema description coverage, and the description never mentions it at all — no indication of what a domain value means here, whether it is a NetBIOS name, FQDN, or an LDAP base, or why it is optional. With low coverage the description was required to compensate and does not.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource: 'Report the identity the connection is bound as.' That is unambiguous and clearly distinct from neighboring tools like get_domain_info, test_connection, or is_member, none of which report the bound auth identity.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies when the tool is applicable by noting it works with Kerberos/SASL-GSSAPI and simple user/password bind, but it never states when to prefer this over siblings (e.g., test_connection or get_domain_info) or any preconditions/exclusions. Usage is inferable, not stated.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.