execute_shell

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations present, the description carries the full behavioral burden and does so thoroughly: it discloses the execution model (bash -c / powershell.exe -Command), the return payload (stdout, stderr, exit codes, signals), timeout-driven termination, symlink resolution and path validation, per-command approval in chains, blocked dangerous patterns, and the operator-only override. This is exactly the mutation/auth/security context an agent needs.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with the core action, then cleanly organized into a security-requirements block and a final imperative. It is long, and a few facts (timeout termination, workdir validation) are repeated from the schema, which slightly dilutes density, but the structure is easy to scan and nothing is padded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 5-parameter, no-annotation, no-output-schema mutation tool, the description covers everything an agent needs: execution semantics, return contents, timeout behavior, approval flow, directory prerequisites, and command-syntax restrictions. Return values are described inline, which is necessary given there is no output schema.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is already 100%, so the schema documents all five parameters. The description still adds value by clarifying workdir resolution ('workdir parameter or process.cwd()') and its validation, reinforcing the timeout termination behavior, and explicitly instructing the agent to always populate the description parameter with what and why. The requiresApproval deprecation is left to the schema only.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a precise verb+resource ('Execute shell commands on the host system') and immediately frames the scope with security controls, clearly separating it from the file-oriented siblings like read_file, write_file, or grep_files. An agent knows exactly what this tool does without inspecting the schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Prerequisites are explicit: at least one approved directory must be configured, workdir must be within allowed directories, and every command requires user approval. It also enumerates when-not conditions (newlines, command substitution, backticks, grouping, heredocs, escaped quotes). It never names an alternative sibling (e.g., prefer read_file/grep_files over shell for file reads), so it stops short of full routing guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.