Revoke API Key

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare destructiveHint=true and idempotentHint=false, and the description goes further to disclose the actual blast radius: the key is revoked permanently, every tool stops working until a new key is configured, and an OAuth-connected app (ChatGPT, Claude) is disconnected. That is exactly the consequence-level information an agent needs before an irreversible call, well beyond what the annotations convey.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Roughly five short sentences, front-loaded with the destructive action and scope limit, then consequences, then the confirmation requirement, then the out-of-scope pointer. No filler or restatement of the title.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a destructive, non-idempotent, no-output-schema tool, the description covers scope, irreversibility, downstream failure mode, confirmation protocol, and where to handle other keys. Nothing material is missing, and the return format need not be explained for a revoke action.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the schema already documents both parameters; the description adds intent by framing `confirm` as a human-in-the-loop gate ("Confirm with the user first; `confirm` must be 'revoke'"). It does not mention the `dry_run` escape hatch, which is left entirely to the schema, so it stops short of a 5.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

Specific verb ("Permanently revoke") plus precise resource and a hard scope limit: "the API key (or connection) this server is using right now, and only that one: a key cannot revoke any other." This cleanly separates it from siblings like request_api_key, retrieve_api_key, and get_api_settings.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicit when-to-use ("when the user is finished with this key, or it may have leaked") and an explicit alternative for everything out of scope ("Other keys are managed at https://porkbun.com/account/api"). It also sets a precondition — confirm with the user first — that routes the agent's decision, not just the call.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.