Server Quality Checklist

Tool Scores

• inspect_flowA
  3.6/5.0
  Behavior3/5

  Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

  With no annotations, the description carries the burden of explaining behavior. It usefully details what the tool returns e.g., both header sets, both bodies, latency, curl command, but it does not explicitly state that this is a read-only operation or disclose constraints like body_max truncation or potential errors.

  Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

  Conciseness5/5

  Is the description appropriately sized, front-loaded, and free of redundancy?

  The description is a single tightly written sentence that front-loads the core purpose and then packs concrete useful specifics. Every listed item earns its place, and there is no fluff or repetition.

  Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

  Completeness3/5

  Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

  An output schema exists, so return values need not be explained. However, the description omits any guidance on body_max and does not explicitly route the agent toward this tool versus siblings Morgue. It is adequate for a simple inspect operation but has clear gaps around parameter behavior and when to use it.

  Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

  Parameters2/5

  Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

  Schema description coverage is 0%, so the description must compensate. It implies flow_id selects the flow to inspect, but body_max is completely unexplained and its relationship to 'both bodies' is unclear. The agent cannot infer the significance of body_max from the description.

  Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

  Purpose5/5

  Does the description clearly state what the tool does and how it differs from similar tools?

  The description opens with a specific verb and resource: 'Full detail for one flow.' It then enumerates the exact contents returned (URL, query params, headers, bodies, latency, curl command), making it easy to distinguish from siblings like list_flows, flow_stats, or diff_flows.

  Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

  Usage Guidelines3/5

  Does the description explain when to use this tool, when not to, or what alternatives exist?

  The phrase 'Full detail for one flow' implies this is for deep inspection of a single flow rather than listing or comparing, but it never explicitly states when to choose this over siblings or provides any exclusion criteria. The usage context is clear but only implied.

  Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

• flow_statsA
  3.9/5.0
  Behavior3/5

  Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

  No annotations are provided, so the description must carry the burden. It does disclose one important behavioral trait: 'numeric path segments are normalised to {n}', which is a non-obvious aggregation behavior. However, it doesn't explicitly state whether the tool is read-only, whether any caching/rate limits apply, or any other side effect. The normalization detail earns a 3.

  Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

  Conciseness5/5

  Is the description appropriately sized, front-loaded, and free of redundancy?

  Three sentences each earn their place: the first is a dense summary of what the tool returns, the second gives context and value, the third explains a critical data-normalization rule. Zero padding, front-loaded with the resource and purpose.

  Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

  Completeness4/5

  Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

  Given the tool's low complexity (one optional param, an output schema exists, and no nested objects), the description is largely complete. It explains what it reports, when to use it, and one important normalization behavior. It doesn't elaborate on the parameter or detail 'asset ratio', but the output schema covers return details. A 4 is appropriate.

  Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

  Parameters2/5

  Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

  The description does not mention the sole parameter 'top_endpoints' at all. Schema description coverage is 0%, so the description should compensate, but it only says 'hottest endpoints', leaving the relationship between the parameter and the result implied. The parameter's name is a slight hint but the description adds essentially no semantic value beyond that.

  Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

  Purpose5/5

  Does the description clearly state what the tool does and how it differs from similar tools?

  The description opens with a clear verb and resource: 'Overview of captured traffic' and then specifies the exact dimensions (hosts, status codes, asset ratio, hottest endpoints). It also contains a strong distinguisher from siblings: 'the first thing to run against an unfamiliar site' is positioning that separates it from inspect_flow, search_flows, and replay_flow.

  Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

  Usage Guidelines4/5

  Does the description explain when to use this tool, when not to, or what alternatives exist?

  Explicit usage context is given: 'This is the first thing to run against an unfamiliar site' and it explains why it helps (tells you the interesting host and whether anything is failing). It doesn't name specific sibling tools for non-existent cases, so it's clear but lacks exclusions, putting it at a 4.

  Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

• list_flowsA
  4/5.0
  Behavior4/5

  Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

  With no annotations, the description carries the burden and discloses meaningful behavior: newest-first ordering, default asset exclusion with the include_assets escape hatch, and exact matching semantics for url_contains and content_type. It stops short of mentioning pagination, rate limits, or auth, but the output schema likely covers return shape.

  Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

  Conciseness4/5

  Is the description appropriately sized, front-loaded, and free of redundancy?

  The description is front-loaded with the purpose and then organized by behavior and parameter guidance; most sentences earn their place. The 'single biggest signal-to-noise win' phrase is slightly promotional but harmless, and the paragraph breaks make it scannable.

  Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

  Completeness4/5

  Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

  For a 9-parameter tool with no annotations, the description covers the core list filtering behavior, asset exclusion, and matching details. It does not explicitly route to search_flows for more complex search scenarios, and a few parameters are undocumented, but the output schema and obvious parameter names fill most remaining gaps.

  Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

  Parameters4/5

  Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

  The description adds non-obvious semantics for include_assets, since_seconds, marked_only, url_contains, and content_type beyond the bare schema, which has 0% description coverage. Host, limit, method, and status_code are left to their self-explanatory names/defaults, which is a minor gap but not a fatal one.

  Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

  Purpose4/5

  Does the description clearly state what the tool does and how it differs from similar tools?

  Purpose is immediately stated as 'List recent flows, newest first' — a specific verb, resource, and ordering. It is clearly distinct from inspect_flow, get_content, or diff_flows, though it does not explicitly call out search_flows as the alternative for more complex queries.

  Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

  Usage Guidelines4/5

  Does the description explain when to use this tool, when not to, or what alternatives exist?

  The description gives concrete usage context: static assets are excluded by default unless include_assets=True, since_seconds is framed as isolating a user's UI click, and marked_only targets flows marked in the UI. It does not state when to prefer list_flows over search_flows, so no explicit exclusion or alternative is given.

  Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

• diff_flowsA
  4.1/5.0
  Behavior4/5

  Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

  With no annotations, the description carries the full burden and discloses rich behavior: unchanged parameters are omitted from output, JSON bodies are flattened to a.b.c keys and compared per key, and non-JSON bodies are returned verbatim. The only gap is that the effect of body_max is never disclosed.

  Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

  Conciseness4/5

  Is the description appropriately sized, front-loaded, and free of redundancy?

  Three dense paragraphs, each earning its place: purpose, usage workflow, and body-handling semantics. The core purpose is front-loaded and the explanatory detail about output omission and flattening is tightly written with no filler.

  Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

  Completeness4/5

  Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

  An output schema exists, so return values need no explanation. The description covers purpose, workflow, output semantics, and JSON/non-JSON handling comprehensively. The remaining gaps are the unexplained body_max parameter and whether headers are compared alongside bodies.

  Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

  Parameters3/5

  Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

  With 0% schema description coverage, the description must compensate. It contextualizes the two required flow_id parameters well ('call the same endpoint twice'), but never explicitly maps them to the schema fields and leaves body_max entirely unexplained despite it having a default value.

  Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

  Purpose5/5

  Does the description clearly state what the tool does and how it differs from similar tools?

  The opening line 'Compare two requests field by field — the tool for reverse-engineering signatures' states a specific verb, resource, and a distinctive purpose that separates it from siblings like inspect_flow (single flow) and replay_flow (execution). An agent can tell exactly what this tool is for without opening the schema.

  Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

  Usage Guidelines4/5

  Does the description explain when to use this tool, when not to, or what alternatives exist?

  Gives clear when-to-use context: 'call the same endpoint twice (or capture it before and after paging), then diff.' It explains what the output means and how to interpret the varying fields for signature reverse-engineering. However, it does not explicitly name sibling alternatives or state when not to use it.

  Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

• generate_codeA
  4.1/5.0
  Behavior4/5

  Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

  No annotations are provided, so the description carries the full burden, and it discloses several important behaviors: order is preserved, requests share one Session for cookie continuity, and specific framework defaults are explained. It also mentions that original headers are kept except client-managed ones. It does not cover all nuances like body_max or impersonate behavior, but the disclosed behavior is substantive.

  Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

  Conciseness4/5

  Is the description appropriately sized, front-loaded, and free of redundancy?

  The description is efficient and front-loaded, with the first sentence stating the purpose immediately. Each subsequent sentence adds useful information about input formats, frameworks, or headers. It's not perfectly tight—the header and framework details could be merged without loss—but it earns a solid 4.

  Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

  Completeness4/5

  Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

  Given the complexity of 4 parameters and 0% schema coverage, the description covers the key usage behaviors well: input formats, ordering, session/cookie continuity, framework variations, and header filtering. It lacks explanation for body_max, impersonate, and the precise nature of the return value, but the presence of an output schema mitigates the last missing piece.

  Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

  Parameters3/5

  Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

  Schema description coverage is 0%, requiring the description to compensate, and it does for flow_ids by clarifying that it accepts a list or comma-separated string with order preservation. It also explains the framework parameter meaningfully (curl_cffi default, curl emits a shell script). However, body_max and impersonate and both left unexplained, adding deficient coverage for 2 of 4 parameters.

  Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

  Purpose5/5

  Does the description clearly state what the tool does and how it differs from similar tools?

  The description clearly states a specific verb and resource: 'Turn captured flows into a runnable scraper script'. It also states its role as 'the final deliverable', which distinguishes it from siblings like replay_flow or inspect_flow. An agent can tell this tool produces code rather than executing or analyzing flows.

  Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

  Usage Guidelines4/5

  Does the description explain when to use this tool, when not to, or what alternatives exist?

  The description provides clear context by framing the tool as the end deliverable producer, suggesting use at the finalization stage. However, it does not explicitly point to alternatives or state when not to use it (e.g., 'use replay_flow to test instead'). It earns a 4 for clear context without exclusions.

  Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

• get_contentA
  4.1/5.0
  Behavior3/5

  Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

  With no annotations, the description carries the burden. It states the body is already decoded (gzip/brotli), which is useful behavioral context. However, it does not disclose potential performance impacts, rate limits, or what happens when max_bytes is exceeded. The decoding note adds value, but it's minimal.

  Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

  Conciseness5/5

  Is the description appropriately sized, front-loaded, and free of redundancy?

  The description is concise, with two sentences: the first states the core purpose, and the second provides usage guidance. It is front-loaded with the most important information and contains no fluff.

  Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

  Completeness4/5

  Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

  The tool is simple, but the description omits details like what happens when max_bytes is exceeded, whether partial bodies are returned, or error handling. Since an output schema exists, return format is covered elsewhere, but behavioral nuances are missing. Still, for a straightforward fetch tool, it is adequate.

  Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

  Parameters2/5

  Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

  Schema description coverage is 0%, so the description must compensate. The description mentions 'which = request | response' and implies max_bytes for large bodies, but doesn't explain the meaning of flow_id or the default behavior of max_bytes. It does not fully specify parameter formats or constraints, leaving gaps.

  Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

  Purpose5/5

  Does the description clearly state what the tool does and how it differs from similar tools?

  The description clearly states the tool's purpose: fetching the full body of a request or response, with gzip/brotli already decoded. It distinguishes itself from sibling tool inspect_flow by specifying it is for large bodies, contrasting with inspect_flow's 4000-character preview.

  Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

  Usage Guidelines5/5

  Does the description explain when to use this tool, when not to, or what alternatives exist?

  The description explicitly says 'Use this instead of inspect_flow when the body is large and you need more than inspect_flow's 4000-character preview.' This provides clear when-to-use guidance and names the alternative, fulfilling the dimension perfectly.

  Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

• statusA
  4.1/5.0
  Behavior2/5

  Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

  With no annotations provided, the description carries the full burden of disclosing behavioral traits. It fails to state whether the operation is read-only, has side effects, requires authentication, or has any latency considerations. Although the purpose implies a simple connectivity check, the absence of any explicit behavioral disclosure is a notable gap.

  Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

  Conciseness5/5

  Is the description appropriately sized, front-loaded, and free of redundancy?

  The description is two short sentences with zero fluff. The primary action ('Check connectivity... and report how many flows are captured') is front-loaded, immediately followed by usage guidance ('Start here when something is not working'). Every word earns its place.

  Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

  Completeness5/5

  Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

  Given the tool's simplicity (no parameters, an output schema is present), the description sufficiently covers the purpose and usage. The existence of an output schema means return values are documented separately, so the description need not explain them. The tool is a simple status check, and the description provides all necessary context for an agent to call it correctly.

  Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

  Parameters4/5

  Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

  The tool has zero parameters, so the description need not explain parameter behavior. The schema coverage is 100% (no properties), and the baseline for zero parameters is 4. The description adds no parameter info because none exist, which is appropriate.

  Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

  Purpose5/5

  Does the description clearly state what the tool does and how it differs from similar tools?

  The description clearly states the action: 'Check connectivity to mitmweb' and the outcome: 'report how many flows are captured.' This specific verb+resource pairing distinguishes it from sibling tools like list_flows (which lists flows) and flow_stats (which likely gives detailed statistics). The phrase 'Start here when something is not working' adds a clear diagnostic role, cementing its unique purpose.

  Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

  Usage Guidelines4/5

  Does the description explain when to use this tool, when not to, or what alternatives exist?

  The description provides explicit when-to-use guidance: 'Start here when something is not working.' This implies it is the first diagnostic step when connectivity or flow capture is suspected to be failing. However, it does not explicitly list alternatives or state when not to use it, so it stops short of the full 5.

  Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

• search_flowsA
  4.2/5.0
  Behavior4/5

  Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

  With no annotations provided, the description carries the full disclosure burden. It does well by explaining search scope values, regex behavior, backward scanning order, and the max_scan bound. It does not clarify how limit or include_assets affect results, which is a real but minor transparency gap.

  Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

  Conciseness5/5

  Is the description appropriately sized, front-loaded, and free of redundancy?

  The description is efficiently structured in three short sections: core purpose, motivating use case, and technical parameter details. It is front-loaded with the most important information and contains no filler or repetition.

  Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

  Completeness4/5

  Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

  For a search tool with an output schema, the description covers the core invocation path thoroughly: what to search, why, how scope works, and scan limits. The main omissions are the semantics of limit and include_assets, and the lack of explicit guidance on when not to use this tool versus siblings.

  Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

  Parameters3/5

  Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

  Schema description coverage is 0%, so the description must compensate. It adds real meaning for keyword, scope, regex, and max_scan, including a concrete regex example. However, it completely omits limit and include_assets, leaving two of six parameters semantically undefined.

  Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

  Purpose5/5

  Does the description clearly state what the tool does and how it differs from similar tools?

  The description opens with a specific verb and resource: 'Full-text search across flows'. It also articulates the exact question the tool answers ('which request carried or returned this value?') and frames it as the entry point for reverse-engineering an API, making it easy to distinguish from sibling tools like list_flows or inspect_flow.

  Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

  Usage Guidelines4/5

  Does the description explain when to use this tool, when not to, or what alternatives exist?

  Usage guidance is explicit and actionable: it says this is the usual entry point for reverse-engineering an API and gives a concrete workflow (take a distinctive value visible in the page, search for it, find the endpoint). It does not explicitly name alternatives or exclusion criteria, but the use case is clear enough to route an agent.

  Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

• replay_flowA
  4.4/5.0
  Behavior4/5

  Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

  With no annotations, the description carries the full burden, and it does well: it discloses that the request goes through mitmproxy with curl_cffi/browser impersonation, that this creates a new flow in mitmweb, and that existing flows are never modified. It could add what happens on timeout or failure, but the key behavioral safety profile is clear.

  Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

  Conciseness5/5

  Is the description appropriately sized, front-loaded, and free of redundancy?

  Three short paragraphs each earn their place: purpose, side-effect/behavior, and parameter semantics. The most important scoping statement ('existing flows are never modified') is placed early, and the example makes the headers semantics concrete without bloat.

  Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

  Completeness4/5

  Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

  The description covers what the tool does, how the request is transported, the side effect in the UI, and how the main optional parameters behave. Given that an output schema exists, return values are not required; minor gaps around body_max/timeout keep this from a 5.

  Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

  Parameters4/5

  Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

  Despite 0% schema description coverage, the description explains the important parameters: header override/add semantics with an example, body replacement with JSON serialization for dicts/lists, and accepted impersonate values. It leaves timeout and body_max to their names/defaults, but the core parameters are meaningfully documented.

  Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

  Purpose5/5

  Does the description clearly state what the tool does and how it differs from similar tools?

  States the precise action 'Replay a request' and immediately adds the optional modifications (method, headers, body), so an agent knows exactly what the tool does. The 'like Burp Repeater' analogy and the note that it creates a new flow while existing flows are never modified clearly separate it from the inspection/status/diff sibling tools.

  Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

  Usage Guidelines4/5

  Does the description explain when to use this tool, when not to, or what alternatives exist?

  The description gives clear context: it is for replaying a captured request, optionally rewriting it, and observing the result as a new flow in mitmweb. It does not explicitly compare itself to sibling tools like inspect_flow or generate_code, so it stops short of a 5.

  Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

• detect_authA
  4.5/5.0
  Behavior4/5

  Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

  With no annotations, the description carries the burden of explaining behavior. It discloses that the tool scans all traffic, reports auth schemes, and that findings include sample flow ids. This goes beyond the empty input schema and gives useful implementation detail about the result format.

  Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

  Conciseness5/5

  Is the description appropriately sized, front-loaded, and free of redundancy?

  The description is compact and front-loaded with the core purpose, followed by the when-to-use guidance and a practical pointer to a sibling tool. Every sentence adds value and there is no redundant restating of the tool name.

  Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

  Completeness5/5

  Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

  For a zero-parameter tool with an output schema, the description is complete: it explains when to run it, what it reports, and how to use the results downstream. The reference to inspect_flow contextualizes the output within the sibling toolset.

  Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

  Parameters4/5

  Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

  The input schema has zero parameters, so the baseline is 4. The description adds context about what the tool does with no arguments and what kind of output to expect, which is sufficient for an agent to invoke it correctly.

  Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

  Purpose5/5

  Does the description clearly state what the tool does and how it differs from similar tools?

  The description states a specific verb ('scan and report') and a clear resource ('which authentication schemes the site uses'). It is immediately distinguishable from sibling tools like inspect_flow or list_flows because it addresses the high-level question of what credentials/mechanisms are needed.

  Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

  Usage Guidelines4/5

  Does the description explain when to use this tool, when not to, or what alternatives exist?

  It gives an explicit trigger: 'Run this when picking up an unfamiliar target.' It also names a specific follow-up tool (inspect_flow) and explains how the output feeds into it. It does not explicitly list when not to use it, but the intended context is clear.

  Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.