Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Goes well beyond the annotations (readOnlyHint=false, openWorldHint=true, destructiveHint=false) by disclosing side effects (each payload would only create an empty canary file), the default safety scope (non-destructive tools only), and the ownership/consent prerequisite. This is exactly the behavioral context an agent needs before invoking a tool that launches a server and executes its tools.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Two dense sentences with zero filler: the action and payload types come first, followed by the safety constraint and exception. Every clause carries information the agent needs.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 7-parameter, no-output-schema tool with real blast radius, the description covers the mechanism, side effects, scope limits, and consent prerequisites, and even summarizes what the run reports ('which parameters reach a shell or the file system unchecked'). Nothing essential to safe invocation is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is moderate (57%) and the description adds rationale for canary_dir (the canary file the payloads attempt to create) and for include_destructive. However, project_dir and host_canary_dir are left unexplained in both description and schema, so the description does not fully compensate for the coverage gap. Baseline 3 for moderate coverage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource (calls every non-destructive tool of one configured server with injection/traversal payloads) plus the outcome reported (which parameters reach a shell or file system unchecked). This is clearly distinguishable from siblings like audit_server_tools or analyze_tool_definitions, which inspect definitions rather than actively probe them.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives explicit gating conditions: 'Only for servers the user develops or operates, ideally a test instance in a container,' and states destructive tools are skipped unless include_destructive is true. It does not name a sibling alternative for the safer static-analysis case, but the when/when-not context is clear.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and openWorldHint=false, and the description corroborates this with 'without connecting to anything', which is helpful but largely restates the annotation. It does not describe what checks are run, what happens on a poisoned definition, or the report/output shape, so it adds only modest value beyond the structured hints.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Two tight sentences with the core action front-loaded and no filler. The offline/CI context follows immediately and every clause carries information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a two-parameter analysis tool with no output schema, the description explains input sourcing and usage context but says nothing about what the analysis returns or how results are surfaced (even though server_name mentions 'the report'). The return contract is left unspecified, which is a moderate gap.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 50%: server_name is documented in the schema but the tools array is not. The description compensates by explaining that tools is the raw tool definitions passed in, e.g. the output of tools/list, which is genuinely useful format guidance beyond the schema. It still leaves the item-level shape unaddressed.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description gives a specific verb and resource ('Runs the tool-poisoning checks on tool definitions you pass in') and clarifies the input source is tools/list output from a server under development. It implicitly separates itself from live-connection siblings like audit_server_tools via 'without connecting to anything', though it never names a sibling explicitly.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

It states clear usage contexts ('Useful in CI or before publishing an MCP server'), which tells an agent when this tool is the right choice. It stops short of naming alternatives or stating when not to use it, so it does not reach a 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Despite annotations already covering safety profile (readOnlyHint=false, destructiveHint=false, idempotentHint=true), the description adds substantial non-obvious behavior: exactly which files are touched (.claude/settings.json, .mcp.json), that every written file is backed up, and crucially that ~/.claude.json is never modified. This is high-value disclosure beyond structured data.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Dense but well front-loaded: the core purpose leads, followed by per-fix behavior and the dry-run/backup safety notes. Almost every sentence earns its place, though the parenthetical explanations add slight length.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a mutating, open-world tool with no output schema, the description covers the files modified, the dry-run default, prerequisites, and backup behavior. Only project_dir lacks an explanation, a minor gap given the overall thoroughness.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With schema coverage at only 33%, the description compensates well: it explains each value of the fixes enum and their effects, the write=true semantics, confirm_launch and confirm_network meanings, and the servers param's role in the permissions fix. Only project_dir is left undocumented.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (fixes) and resource (findings in the project's own files), then enumerates the three concrete fix categories it applies. This cleanly distinguishes it from sibling tools like audit_mcp_config and generate_policy, which diagnose or produce recommendations rather than mutate files.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives explicit conditions per fix type (permissions needs confirm_launch; pin-versions needs confirm_network) and a clear dry-run workflow: call without write=true first, then confirm. It doesn't name specific sibling alternatives to use before/after, but the prerequisites are unusually well specified.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and openWorldHint=false, yet the description still earns credit by adding that it 'launches nothing and sends nothing' — meaningful because an agent may otherwise fear that scanning hook configs or bundled scripts executes or exfiltrates them. The enumerated detection categories (invisible text, credential-file directives, download-and-run, pre-approved unrestricted shell) further describe behavioral scope beyond what annotations convey, though it says nothing about scan cost or how it handles symlinks/large trees.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with what is scanned and where, before the threat list, which is the right order for an agent deciding whether to call it. The second sentence's long enumeration of a dozen threat categories is dense but each item denotes a distinct, non-redundant detection class, so it mostly earns its length.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

No output schema exists, so the description must imply results; the flag list effectively enumerates finding categories, which is adequate for an agent to expect structured findings. It stops short of describing result shape (file paths, severity, remediation) or what happens on a clean scan, and there is no pointer to follow-up siblings like apply_fixes or generate_policy.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so baseline is 3, but the description adds scope semantics the schema lacks: scanning spans the user level, the project, and every enabled plugin by default, which explains what project_only actually narrows away. It doesn't add format or path-behavior detail for project_dir beyond the schema's default note.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and enumerates the exact resource class scanned (CLAUDE.md, skills and bundled scripts, slash commands, subagents, rules, plugin hook configs) plus the three sources (user, project, enabled plugins). The phrase 'besides MCP tools' explicitly carves out the scope handled by sibling tools like audit_mcp_config, so an agent can discriminate without opening a schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is implied rather than stated: the catalog of scanned sources and the threat list signal 'audit before trusting agent config,' and the project_only param mentions 'repositories you are about to trust,' but that guidance lives in the schema, not the description. The description never names an alternative tool (audit_mcp_config, audit_server_tools) or an explicit precondition such as 'run before installing a plugin.'

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and openWorldHint=false, and the description reinforces this while adding genuinely new information: 'launches nothing' tells the agent that pipe-to-shell commands and npx/uvx packages are inspected but never executed, which is a meaningful safety guarantee beyond the annotations. It stops short of describing finding severity, output volume, or how results are ordered.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Purpose is front-loaded in the first clause, followed by a compact checklist of detection categories and a one-clause safety note. The enumeration is long but every item is load-bearing for distinguishing this tool's coverage; no filler sentences.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a zero-required-parameter, read-only scan with no output schema, the description supplies enough to call it correctly: it states the input domain (config), the static/non-executing nature, and the categories of findings an agent should expect back. It does not sketch the return shape, but the finding enumeration is a reasonable proxy.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Single optional parameter with 100% schema description coverage, so the schema already documents project_dir and its default. The description adds no further meaning about path resolution, relative vs absolute paths, or multi-scope behavior, so baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

Specific verb (audit) plus a precisely scoped resource (MCP server configuration) that is explicitly static and config-file-only. The enumeration of seven detection categories (plaintext secrets, plain-HTTP remotes, unpinned npx/uvx, privileged Docker, pipe-to-shell, duplicate names) cleanly separates it from audit_server_tools, check_supply_chain, and adversarial_test without the agent needing to open any schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The scope of the check implies when the tool applies, and 'Static audit' plus 'launches nothing' signals a pre-execution/configuration-review context. However, no sibling is named and there is no explicit when-to-use or when-not-to-use statement relative to audit_server_tools, check_supply_chain, or adversarial_test, so the agent must infer routing.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond readOnlyHint=true and openWorldHint=true, the description discloses that scanning launches server processes or opens HTTP connections, that only initialize and tools/list are sent, and that no scanned tool is ever invoked. This is exactly the extra operational context annotations cannot carry.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loads the action and the threat list, then closes with the key safety guarantee. The parenthetical threat enumeration is dense but each item earns its keeping; two sentences, no filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description should ideally hint at what the audit returns (findings, severity, report shape). It covers invocation behavior thoroughly, but the result format is left unspecified for a tool whose output is the whole point.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is only 50%, and the description adds nothing about the servers list format, project_dir, or timeout beyond what the schema already says. The confirm_launch semantics it implies (requires user consent) are already documented in the schema, so compensation for the coverage gap is marginal.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

States specific verbs and resource: connects to MCP servers, lists tools, and checks names/descriptions/schemas for poisoning, shadowing, and rug pulls. The enumerated threat categories make it clearly distinct from siblings like audit_mcp_config or analyze_tool_definitions.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides context (scan servers for poisoning/rug pulls) and a hard behavioral rule (never calls the scanned tools), which implies when to reach for it. However, it never explicitly contrasts with the overlapping siblings analyze_tool_definitions or audit_mcp_config, so the agent must infer which audit tool applies.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations only declare readOnlyHint and openWorldHint; the description goes far beyond by enumerating the checks (vulnerabilities, malicious versions, typosquats, non-existent names, freshness, install scripts, deprecation, publisher changes) and explicitly disclosing the external endpoints contacted (registry.npmjs.org, pypi.org, api.osv.dev) and that nothing else leaves the machine. That is exactly the exfiltration/consent context an agent needs before invoking a network tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, front-loaded with the applicability condition, then a compact but complete enumeration of behavior. No filler and the privacy statement is placed at the end where it has the most impact.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description covers what is checked and the network/consent implications well, which is the critical information for this tool. It stops short of describing result shape or what happens when confirm_network is false, leaving a small gap.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 75%, so the schema carries most parameter meaning, but the description adds the concrete destination domains behind confirm_network and reiterates that only names and versions are transmitted, which the schema's terse 'must be true' note does not. It also contextualizes scan_images indirectly via the image-pull note in the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb ('checks the package on its registry and in the OSV database') plus the precise resource and scope ('for servers launched with npx/uvx and similar'), and then enumerates exactly what checks are performed. This clearly separates it from siblings like audit_mcp_config or audit_server_tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The opening clause gives a clear trigger condition ('For servers launched with npx/uvx and similar'), which tells the agent when this tool applies, and the confirm_network requirement is surfaced. However, it never names an alternative sibling or states when not to use it (e.g., vs. audit_mcp_config for non-npx servers).

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and openWorldHint=false, and the description still adds material context: the tool is static and local, nothing is launched or sent, and the output deliberately excludes paths, arguments, environment variables and secrets. That last point is exactly the kind of disclosure an agent needs before deciding the output is safe to share or summarize. No contradiction with the annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, front-loaded with what the inventory contains and then the format and safety notes. The content enumeration is long but every item adds scope information the schema does not carry. Slightly dense; a list or line break would aid scanning, but nothing is filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

There is no output schema, and the description picks up that slack by characterizing both return formats (Markdown overview vs CycloneDX 1.6 JSON). The static/local guarantee and exclusion of secrets complete the safety picture. Missing only is default behavior for `project_dir` and whether unpinned or unendorsed assets appear in the inventory.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is only 33%, so the description carries extra burden. It compensates well for `format`, explaining that summary yields a Markdown overview and cyclonedx a CycloneDX 1.6 JSON document, but `project_dir` has no explanation anywhere, and the interaction between `project_only` and `project_dir` is left unclear. Partial compensation justifies a mid score rather than a low one.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a concrete artifact (a bill of materials) and enumerates its contents precisely: MCP servers, plugins, skills, commands, subagents, CLAUDE.md and hook configs, with SHA-256, pin status, scores and OWASP evidence. That is far more specific than the title alone, and the two output formats are spelled out. It never names a sibling such as audit_agent_context or security_dashboard, so the agent must infer how this differs from those, which keeps it off a 5.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is only implied: 'format=summary is a Markdown overview for audits' hints at the audit scenario, and the CycloneDX option hints at machine-consumable export. There is no explicit statement of when to pick this over the other audit/dashboard tools, and no exclusions. The format guidance is useful but stops short of real routing guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The readOnlyHint annotation is confirmed and reinforced ('Read-only: returns the JSON, does not write it'), and the description adds substantive behavior: exactly what the policy approves, that it pins versions, and its downstream enforcement role. It stops short of 5 only because it says nothing about the returned JSON's shape or any size/limit caveats.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Three sentences, each doing distinct work: what is returned, how to use it, and the read-only guarantee. The most important information (the artifact produced) is front-loaded with no filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description correctly specifies that it returns JSON rather than writing it, and explains the policy's enforceability downstream. The only meaningful omission is the undocumented project_dir parameter and whether it defaults to the current working directory.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

There is one parameter (project_dir) with 0% schema description coverage, and the description never mentions it or explains what directory it should point at or what the default is. Since the schema does no work here, the description needed to compensate and does not.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

States a precise verb and artifact: it returns a .mcp-security.json policy approving the currently configured MCP servers and their remote hosts, with pinned versions. This is clearly distinguishable from siblings like list_mcp_servers or pin_tools, which read or mutate state rather than emit a policy file.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives a clear operative context: commit the returned file to the repository so CI, session checks and audits flag later-added shadow servers. It does not explicitly name an alternative or state a when-not condition, so it stops short of a 5, but the intended workflow is unambiguous.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and openWorldHint=false, so the safety profile is covered. The description adds genuine extra context beyond that: it reads config files only and launches no processes, which tells the agent this is a passive filesystem read rather than a live connection attempt.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Two tight sentences with zero filler, and the scope of what gets listed is front-loaded ahead of the behavioral caveat. Every clause earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

There is no output schema, but the description gestures at the return shape ('with its transport') and the scopes covered. For a simple one-optional-param read tool with annotations carrying the safety profile, this is nearly complete, with only the exact result fields left unspecified.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% for the single project_dir parameter, so the schema already carries the semantics. The description adds no defaulting or format guidance beyond what the schema states, so the baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Lists every MCP server configured for this project') and enumerates the exact scopes covered (user, local, project in Claude Code, plus Claude Desktop). It does not explicitly name a sibling such as audit_mcp_config to differentiate the inventory use case from an audit use case, so it stops short of a 5.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The clause 'Reads config files only; launches nothing' implies the tool is for static inventory rather than live probing, which is useful context. However, it never says when to prefer this over siblings like audit_mcp_config or audit_server_tools, leaving the routing decision to inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations declare readOnlyHint=false, idempotentHint=true and destructiveHint=false, and the description is consistent with them: it discloses that it writes a pin file while only reading source files and launching nothing, and that findings-based skipping is the default. The one ambiguity is whether an existing pin file is overwritten or merged, which an idempotent mutation arguably warrants stating.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Three tight sentences with no filler; the scoping and write target come first, prerequisites and force behavior follow. The opening sentence is long because of the enumerated resource list, but that enumeration is load-bearing rather than padding.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description still tells the agent what is persisted (hashes per origin) and what later consumers do with it, and it covers the safety gate. What's missing is the outcome of a call (count of pinned items, which origins were skipped) and any mention that pins persist across sessions.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 67%, so the schema already documents force and origins well. The description reinforces force semantics ('unless force is true') but adds nothing about origins beyond what the schema states, and project_dir is left entirely to the schema. Baseline 3 is appropriate given the mid-range coverage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

Specific verb (records a SHA-256) plus enumerated resources (skills, commands, subagents, rules, CLAUDE.md, plugin hooks, bundled scripts) and the exact output location (~/.claude/mcp-security/context-pins.json). It also names the downstream consumer (later scans and session-start check), which no sibling tool description would imply.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

States the prerequisite explicitly: pin only after the user has reviewed an audit_agent_context report, and critical/high origins are skipped unless force is true. It also explains the motivating scenario (rug-pull: a plugin changing files without a new version), so an agent knows exactly when this tool is the right call versus re-running the audit.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations declare readOnlyHint=false, destructiveHint=false, idempotentHint=true, openWorldHint=true; the description explains *why* it is a non-read operation — it launches/connects to each server and writes a hash file — plus a user-consent precondition. It stops short of describing failure modes (unreachable server, existing pin mismatch) or whether a prior pin is overwritten.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Three tight sentences: what gets written and where, the rug-pull rationale, the ordering prerequisite, and the launch behavior. The critical gating instruction is front-loaded and nothing is padded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a state-mutating, process-launching tool with no output schema and half its parameters undocumented, the description covers intent and precondition adequately but omits return/results reporting and error behavior. An agent would need to guess what it gets back after pinning.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is only 50%, with project_dir and timeout_seconds carrying no schema description, and the tool description says nothing about these or about the servers wildcard syntax. The description therefore adds no parameter meaning and does not compensate for the coverage gap.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

Names a specific verb and resource ('Records a SHA-256 hash of every tool definition of the selected servers') and states the artifact written (~/.claude/mcp-security/pins.json) plus the rationale ('so later audits can detect rug pulls'). It also positions itself relative to the sibling audit_server_tools, so an agent can distinguish it from audit/report tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicit prerequisite: 'Pin only after the user has reviewed an audit_server_tools report for these servers,' which names the alternative tool and the condition that gates use. It does not spell out when *not* to use it (e.g. re-pinning after config changes) or how it differs in scope from apply_fixes, but the routing signal is clear.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already cover the safety profile (readOnlyHint=true, openWorldHint=false), so the description's real value-add is the data-handling disclosure: the log stores only hashes and sizes, never arguments or outputs. That tells the agent what evidence it can and cannot retrieve, which is meaningful context beyond the annotations. It stops short of describing output format or result volume.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

A single dense sentence that front-loads what the tool summarises and then appends the privacy constraint. No filler, though the 2160-hour cap interaction is left implicit.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description does the work of explaining what the response contains (per-server/tool counts plus credential and injection flags) and what the underlying log does not retain. That is close to complete for a read-only, one-parameter query tool; only ordering/aggregation detail is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% for the single since_hours parameter with its default, maximum and exclusiveMinimum, so the schema carries the semantics. The description adds nothing about the time window or defaults, making 3 the correct baseline.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description gives a specific verb (summarises) and resource (the local audit log written by the plugin's hooks), then enumerates exactly what the summary contains: per-server/per-tool call counts and flagged calls. That distinguishes it from config-oriented siblings like audit_mcp_config or audit_server_tools, though it never names an alternative explicitly.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no statement of when to reach for this tool versus the other audit/security siblings, no prerequisites, and no exclusions. An agent can infer it is for reviewing historical call activity, but must guess the routing itself.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare the write/network/idempotent profile, so the bar is lower, and the description adds real context beyond them: the request is sent to the team backend, a human admin decides out-of-band on the command line, and the tool itself grants nothing. It does not explain what happens to the request afterwards or whether duplicates collapse, despite idempotentHint=true.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Three short sentences with the action, the trigger, and the capability limit front-loaded in that order. No redundant restatement of the title or schema.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a network-touching request tool with no output schema, the description covers what is created, where it goes, and who resolves it, which is enough to call it correctly. A brief statement about the returned acknowledgement or subsequent approval status would close the remaining gap.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 75% schema coverage the baseline is 3, and the description earns an extra point by illustrating the identity format (project:linear) that maps to the schema's scope:name pattern. It says nothing about note or confirm_network, which the schema already documents, so it adds example semantics rather than new parameter detail.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb+resource ("Creates an approval request in the user's organisation") scoped to two artifact types, MCP server or plugin, and gives a concrete identity example (project:linear). It also draws a hard boundary the siblings don't cover: "this tool cannot approve anything."

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives an explicit trigger ("when the team policy blocks it or does not list it") and a gating restriction ("Use it only when the user asks"), which is clear when-to-use and when-not guidance. It stops short of naming a sibling to check policy status first, but no sibling obviously fills that role.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations declare readOnlyHint=true and openWorldHint=true, but the description adds the non-obvious behavioral fact that scan='full' actually launches the configured servers, that no tool is invoked during that process, and that a confirmation flag plus user consent is required. This is meaningful context beyond the annotations, though it does not describe latency, failure handling, or what happens to already-running servers.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loads the core action and then packs the mode semantics into short, dense sentences with no filler. The long enumeration in the opening sentence is justified by the many dashboard sections, though it does make the first sentence heavy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For an interactive, open-world tool with no output schema, the description covers what the dashboard shows, the two scan modes, and the safety gate. The remaining gap is project_dir, which is undocumented anywhere, leaving the agent unable to know whether it must supply a working directory.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must carry the parameter burden. It explains scan='config' vs scan='full' and the confirm_launch=true requirement well, which compensates for two of three parameters, but project_dir is never mentioned and its purpose is left entirely to inference.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Opens the interactive mcp-security-guard dashboard') and then enumerates exactly what the surface contains: scores/grades per server, severity-filterable findings, OWASP MCP Top 10 breakdown, permission rules, pin buttons. An agent knows precisely what it gets. It does not explicitly contrast itself with text-only siblings such as audit_mcp_config, so it lands just short of a 5.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives clear mode-selection guidance: scan='config' reads files only, scan='full' starts servers and requires confirm_launch=true, with an explicit 'ask the user first' instruction. What is missing is routing guidance against sibling tools (e.g., when to use audit_mcp_config or list_mcp_servers instead of opening the dashboard).

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With annotations already declaring openWorldHint=true and destructiveHint=false, the description still adds substantial context: the exact data that leaves the machine, an explicit exclusion list ('never paths, arguments, environment, headers or secrets'), the admin-side fleet-visibility prerequisite, and the preview-before-send workflow. This is exactly the kind of disclosure an agent needs for an outward-facing send operation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The preview/send distinction is front-loaded in the first clause, and the parenthetical payload enumeration is long but each item carries real information about what is transmitted. It is dense rather than padded, though the single-sentence structure with nested commas takes effort to parse.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

There is no output schema, and the description compensates well by describing the preview contents, so an agent knows what to expect from a dry run. The only real gap is project_dir, which is neither required nor described anywhere, leaving its role to be inferred from the name.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 50%: confirm_send is documented in the schema, but the description reinforces it by tying 'true' to the human-agreement step ('after the user has seen the preview and agreed'), which is meaningful behavioral text beyond the schema. project_dir is left entirely unexplained in both schema and description, which keeps this below a 5.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a specific verb and resource ('shows exactly what a fleet report would send') and clearly separates the two modes: preview by default, actual transmission with confirm_send=true. The enumerated payload contents (server names, scopes, transport, package names/versions, remote hostnames, plugin names/versions) make it distinguishable from siblings like export_bom or team_status without opening the schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives explicit gating conditions: 'Only when the user asks,' 'after the user has seen the preview and agreed,' and 'if the admin turned fleet visibility on.' That is strong when-to-use guidance, but it never names an alternative sibling (e.g., export_bom for a full BOM) or states when this should not be used instead of them.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond annotations, the description discloses that the API key is sent to the team backend, that only the API key is sent, that the response is cached locally, and that the fetched policy is enforced alongside the user's own policy. This adds meaningful auth, network, and side-effect context for an open-world, non-read-only tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact and front-loads the core purpose before prerequisites and behavioral details. Every sentence contributes useful information about what is synced, what is shown, what credentials are needed, and what is transmitted.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's side effect and network access, the description covers the key auth requirement, what is sent, caching behavior, and the information surfaced by the status check. It is nearly complete for a one-parameter tool without an output schema, though it could clarify the user-confirmation requirement more directly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

There is only one parameter and the schema description coverage is 100%, so the schema already explains that `confirm_network` must be true and that the user should be asked first. The description reinforces that the API key is sent to the backend but does not add parameter-specific semantics beyond the schema; baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description states specific actions and scope: syncing the organisation policy from the team backend and showing organisation, role, policy version, and fleet reporting status. It is clear what the tool does, though it does not explicitly distinguish itself from the sibling `team_report` or other team-related tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives a prerequisite (a team API key via MCP_SECURITY_API_KEY or plugin setting) and notes that the answer is cached locally. However, it does not explicitly say when to use this tool versus alternatives such as `team_report`, nor does it state exclusions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.