Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Goes well beyond the annotations (readOnlyHint=false, openWorldHint=true, destructiveHint=false) by disclosing side effects (each payload would only create an empty canary file), the default safety scope (non-destructive tools only), and the ownership/consent prerequisite. This is exactly the behavioral context an agent needs before invoking a tool that launches a server and executes its tools.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Two dense sentences with zero filler: the action and payload types come first, followed by the safety constraint and exception. Every clause carries information the agent needs.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 7-parameter, no-output-schema tool with real blast radius, the description covers the mechanism, side effects, scope limits, and consent prerequisites, and even summarizes what the run reports ('which parameters reach a shell or the file system unchecked'). Nothing essential to safe invocation is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is moderate (57%) and the description adds rationale for canary_dir (the canary file the payloads attempt to create) and for include_destructive. However, project_dir and host_canary_dir are left unexplained in both description and schema, so the description does not fully compensate for the coverage gap. Baseline 3 for moderate coverage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource (calls every non-destructive tool of one configured server with injection/traversal payloads) plus the outcome reported (which parameters reach a shell or file system unchecked). This is clearly distinguishable from siblings like audit_server_tools or analyze_tool_definitions, which inspect definitions rather than actively probe them.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives explicit gating conditions: 'Only for servers the user develops or operates, ideally a test instance in a container,' and states destructive tools are skipped unless include_destructive is true. It does not name a sibling alternative for the safer static-analysis case, but the when/when-not context is clear.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and openWorldHint=false, and the description corroborates this with 'without connecting to anything', which is helpful but largely restates the annotation. It does not describe what checks are run, what happens on a poisoned definition, or the report/output shape, so it adds only modest value beyond the structured hints.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Two tight sentences with the core action front-loaded and no filler. The offline/CI context follows immediately and every clause carries information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a two-parameter analysis tool with no output schema, the description explains input sourcing and usage context but says nothing about what the analysis returns or how results are surfaced (even though server_name mentions 'the report'). The return contract is left unspecified, which is a moderate gap.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 50%: server_name is documented in the schema but the tools array is not. The description compensates by explaining that tools is the raw tool definitions passed in, e.g. the output of tools/list, which is genuinely useful format guidance beyond the schema. It still leaves the item-level shape unaddressed.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description gives a specific verb and resource ('Runs the tool-poisoning checks on tool definitions you pass in') and clarifies the input source is tools/list output from a server under development. It implicitly separates itself from live-connection siblings like audit_server_tools via 'without connecting to anything', though it never names a sibling explicitly.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

It states clear usage contexts ('Useful in CI or before publishing an MCP server'), which tells an agent when this tool is the right choice. It stops short of naming alternatives or stating when not to use it, so it does not reach a 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Despite annotations already covering safety profile (readOnlyHint=false, destructiveHint=false, idempotentHint=true), the description adds substantial non-obvious behavior: exactly which files are touched (.claude/settings.json, .mcp.json), that every written file is backed up, and crucially that ~/.claude.json is never modified. This is high-value disclosure beyond structured data.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Dense but well front-loaded: the core purpose leads, followed by per-fix behavior and the dry-run/backup safety notes. Almost every sentence earns its place, though the parenthetical explanations add slight length.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a mutating, open-world tool with no output schema, the description covers the files modified, the dry-run default, prerequisites, and backup behavior. Only project_dir lacks an explanation, a minor gap given the overall thoroughness.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With schema coverage at only 33%, the description compensates well: it explains each value of the fixes enum and their effects, the write=true semantics, confirm_launch and confirm_network meanings, and the servers param's role in the permissions fix. Only project_dir is left undocumented.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (fixes) and resource (findings in the project's own files), then enumerates the three concrete fix categories it applies. This cleanly distinguishes it from sibling tools like audit_mcp_config and generate_policy, which diagnose or produce recommendations rather than mutate files.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives explicit conditions per fix type (permissions needs confirm_launch; pin-versions needs confirm_network) and a clear dry-run workflow: call without write=true first, then confirm. It doesn't name specific sibling alternatives to use before/after, but the prerequisites are unusually well specified.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and openWorldHint=false, and the description reinforces this while adding genuinely new information: 'launches nothing' tells the agent that pipe-to-shell commands and npx/uvx packages are inspected but never executed, which is a meaningful safety guarantee beyond the annotations. It stops short of describing finding severity, output volume, or how results are ordered.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Purpose is front-loaded in the first clause, followed by a compact checklist of detection categories and a one-clause safety note. The enumeration is long but every item is load-bearing for distinguishing this tool's coverage; no filler sentences.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a zero-required-parameter, read-only scan with no output schema, the description supplies enough to call it correctly: it states the input domain (config), the static/non-executing nature, and the categories of findings an agent should expect back. It does not sketch the return shape, but the finding enumeration is a reasonable proxy.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Single optional parameter with 100% schema description coverage, so the schema already documents project_dir and its default. The description adds no further meaning about path resolution, relative vs absolute paths, or multi-scope behavior, so baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

Specific verb (audit) plus a precisely scoped resource (MCP server configuration) that is explicitly static and config-file-only. The enumeration of seven detection categories (plaintext secrets, plain-HTTP remotes, unpinned npx/uvx, privileged Docker, pipe-to-shell, duplicate names) cleanly separates it from audit_server_tools, check_supply_chain, and adversarial_test without the agent needing to open any schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The scope of the check implies when the tool applies, and 'Static audit' plus 'launches nothing' signals a pre-execution/configuration-review context. However, no sibling is named and there is no explicit when-to-use or when-not-to-use statement relative to audit_server_tools, check_supply_chain, or adversarial_test, so the agent must infer routing.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond readOnlyHint=true and openWorldHint=true, the description discloses that scanning launches server processes or opens HTTP connections, that only initialize and tools/list are sent, and that no scanned tool is ever invoked. This is exactly the extra operational context annotations cannot carry.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loads the action and the threat list, then closes with the key safety guarantee. The parenthetical threat enumeration is dense but each item earns its keeping; two sentences, no filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description should ideally hint at what the audit returns (findings, severity, report shape). It covers invocation behavior thoroughly, but the result format is left unspecified for a tool whose output is the whole point.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is only 50%, and the description adds nothing about the servers list format, project_dir, or timeout beyond what the schema already says. The confirm_launch semantics it implies (requires user consent) are already documented in the schema, so compensation for the coverage gap is marginal.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

States specific verbs and resource: connects to MCP servers, lists tools, and checks names/descriptions/schemas for poisoning, shadowing, and rug pulls. The enumerated threat categories make it clearly distinct from siblings like audit_mcp_config or analyze_tool_definitions.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides context (scan servers for poisoning/rug pulls) and a hard behavioral rule (never calls the scanned tools), which implies when to reach for it. However, it never explicitly contrasts with the overlapping siblings analyze_tool_definitions or audit_mcp_config, so the agent must infer which audit tool applies.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations only declare readOnlyHint and openWorldHint; the description goes far beyond by enumerating the checks (vulnerabilities, malicious versions, typosquats, non-existent names, freshness, install scripts, deprecation, publisher changes) and explicitly disclosing the external endpoints contacted (registry.npmjs.org, pypi.org, api.osv.dev) and that nothing else leaves the machine. That is exactly the exfiltration/consent context an agent needs before invoking a network tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, front-loaded with the applicability condition, then a compact but complete enumeration of behavior. No filler and the privacy statement is placed at the end where it has the most impact.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description covers what is checked and the network/consent implications well, which is the critical information for this tool. It stops short of describing result shape or what happens when confirm_network is false, leaving a small gap.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 75%, so the schema carries most parameter meaning, but the description adds the concrete destination domains behind confirm_network and reiterates that only names and versions are transmitted, which the schema's terse 'must be true' note does not. It also contextualizes scan_images indirectly via the image-pull note in the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb ('checks the package on its registry and in the OSV database') plus the precise resource and scope ('for servers launched with npx/uvx and similar'), and then enumerates exactly what checks are performed. This clearly separates it from siblings like audit_mcp_config or audit_server_tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The opening clause gives a clear trigger condition ('For servers launched with npx/uvx and similar'), which tells the agent when this tool applies, and the confirm_network requirement is surfaced. However, it never names an alternative sibling or states when not to use it (e.g., vs. audit_mcp_config for non-npx servers).

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The readOnlyHint annotation is confirmed and reinforced ('Read-only: returns the JSON, does not write it'), and the description adds substantive behavior: exactly what the policy approves, that it pins versions, and its downstream enforcement role. It stops short of 5 only because it says nothing about the returned JSON's shape or any size/limit caveats.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Three sentences, each doing distinct work: what is returned, how to use it, and the read-only guarantee. The most important information (the artifact produced) is front-loaded with no filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description correctly specifies that it returns JSON rather than writing it, and explains the policy's enforceability downstream. The only meaningful omission is the undocumented project_dir parameter and whether it defaults to the current working directory.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

There is one parameter (project_dir) with 0% schema description coverage, and the description never mentions it or explains what directory it should point at or what the default is. Since the schema does no work here, the description needed to compensate and does not.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

States a precise verb and artifact: it returns a .mcp-security.json policy approving the currently configured MCP servers and their remote hosts, with pinned versions. This is clearly distinguishable from siblings like list_mcp_servers or pin_tools, which read or mutate state rather than emit a policy file.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives a clear operative context: commit the returned file to the repository so CI, session checks and audits flag later-added shadow servers. It does not explicitly name an alternative or state a when-not condition, so it stops short of a 5, but the intended workflow is unambiguous.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and openWorldHint=false, so the safety profile is covered. The description adds genuine extra context beyond that: it reads config files only and launches no processes, which tells the agent this is a passive filesystem read rather than a live connection attempt.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Two tight sentences with zero filler, and the scope of what gets listed is front-loaded ahead of the behavioral caveat. Every clause earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

There is no output schema, but the description gestures at the return shape ('with its transport') and the scopes covered. For a simple one-optional-param read tool with annotations carrying the safety profile, this is nearly complete, with only the exact result fields left unspecified.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% for the single project_dir parameter, so the schema already carries the semantics. The description adds no defaulting or format guidance beyond what the schema states, so the baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Lists every MCP server configured for this project') and enumerates the exact scopes covered (user, local, project in Claude Code, plus Claude Desktop). It does not explicitly name a sibling such as audit_mcp_config to differentiate the inventory use case from an audit use case, so it stops short of a 5.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The clause 'Reads config files only; launches nothing' implies the tool is for static inventory rather than live probing, which is useful context. However, it never says when to prefer this over siblings like audit_mcp_config or audit_server_tools, leaving the routing decision to inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations declare readOnlyHint=false, destructiveHint=false, idempotentHint=true, openWorldHint=true; the description explains *why* it is a non-read operation — it launches/connects to each server and writes a hash file — plus a user-consent precondition. It stops short of describing failure modes (unreachable server, existing pin mismatch) or whether a prior pin is overwritten.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Three tight sentences: what gets written and where, the rug-pull rationale, the ordering prerequisite, and the launch behavior. The critical gating instruction is front-loaded and nothing is padded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a state-mutating, process-launching tool with no output schema and half its parameters undocumented, the description covers intent and precondition adequately but omits return/results reporting and error behavior. An agent would need to guess what it gets back after pinning.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is only 50%, with project_dir and timeout_seconds carrying no schema description, and the tool description says nothing about these or about the servers wildcard syntax. The description therefore adds no parameter meaning and does not compensate for the coverage gap.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

Names a specific verb and resource ('Records a SHA-256 hash of every tool definition of the selected servers') and states the artifact written (~/.claude/mcp-security/pins.json) plus the rationale ('so later audits can detect rug pulls'). It also positions itself relative to the sibling audit_server_tools, so an agent can distinguish it from audit/report tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicit prerequisite: 'Pin only after the user has reviewed an audit_server_tools report for these servers,' which names the alternative tool and the condition that gates use. It does not spell out when *not* to use it (e.g. re-pinning after config changes) or how it differs in scope from apply_fixes, but the routing signal is clear.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already cover the safety profile (readOnlyHint=true, openWorldHint=false), so the description's real value-add is the data-handling disclosure: the log stores only hashes and sizes, never arguments or outputs. That tells the agent what evidence it can and cannot retrieve, which is meaningful context beyond the annotations. It stops short of describing output format or result volume.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

A single dense sentence that front-loads what the tool summarises and then appends the privacy constraint. No filler, though the 2160-hour cap interaction is left implicit.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description does the work of explaining what the response contains (per-server/tool counts plus credential and injection flags) and what the underlying log does not retain. That is close to complete for a read-only, one-parameter query tool; only ordering/aggregation detail is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% for the single since_hours parameter with its default, maximum and exclusiveMinimum, so the schema carries the semantics. The description adds nothing about the time window or defaults, making 3 the correct baseline.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description gives a specific verb (summarises) and resource (the local audit log written by the plugin's hooks), then enumerates exactly what the summary contains: per-server/per-tool call counts and flagged calls. That distinguishes it from config-oriented siblings like audit_mcp_config or audit_server_tools, though it never names an alternative explicitly.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no statement of when to reach for this tool versus the other audit/security siblings, no prerequisites, and no exclusions. An agent can infer it is for reviewing historical call activity, but must guess the routing itself.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations declare readOnlyHint=true and openWorldHint=true, but the description adds the non-obvious behavioral fact that scan='full' actually launches the configured servers, that no tool is invoked during that process, and that a confirmation flag plus user consent is required. This is meaningful context beyond the annotations, though it does not describe latency, failure handling, or what happens to already-running servers.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loads the core action and then packs the mode semantics into short, dense sentences with no filler. The long enumeration in the opening sentence is justified by the many dashboard sections, though it does make the first sentence heavy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For an interactive, open-world tool with no output schema, the description covers what the dashboard shows, the two scan modes, and the safety gate. The remaining gap is project_dir, which is undocumented anywhere, leaving the agent unable to know whether it must supply a working directory.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must carry the parameter burden. It explains scan='config' vs scan='full' and the confirm_launch=true requirement well, which compensates for two of three parameters, but project_dir is never mentioned and its purpose is left entirely to inference.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Opens the interactive mcp-security-guard dashboard') and then enumerates exactly what the surface contains: scores/grades per server, severity-filterable findings, OWASP MCP Top 10 breakdown, permission rules, pin buttons. An agent knows precisely what it gets. It does not explicitly contrast itself with text-only siblings such as audit_mcp_config, so it lands just short of a 5.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives clear mode-selection guidance: scan='config' reads files only, scan='full' starts servers and requires confirm_launch=true, with an explicit 'ask the user first' instruction. What is missing is routing guidance against sibling tools (e.g., when to use audit_mcp_config or list_mcp_servers instead of opening the dashboard).

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.