Scan app

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Goes well beyond the annotations: it discloses that optional keys are used once and never stored or returned, that read access is required, that usage is limited per credential and globally, and that MCP server health is 'Coming soon' (a known limitation). These are the exact behavioral facts an agent needs before sending secrets, and none are derivable from readOnlyHint/destructiveHint.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The core action and the 'no monitor is created' boundary are front-loaded, and every sentence carries a distinct fact. It is dense — several clauses (limits, key handling, cron source, coming-soon caveat) are packed into one block, which slightly hurts scannability but not information value.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With an output schema handling return values and 100% schema coverage handling parameters, the description fills the remaining gaps: authorization, rate limiting, secret handling, scope boundaries, and a feature that is not yet available. An agent has enough to decide to call it and to call it safely.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is already 100%, so the baseline is 3, but the description adds real semantic value: it explains the purpose of the optional Stripe/Supabase keys (health and 30-day delivery failures), the handling contract for those keys, and that 'crons' comes from repository findings supplied by the client. It does not cover the URL constraint (no credentials/query params), which the schema carries.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Run a one-time silent-failure scan of a public app URL') plus the concrete findings it reports. It explicitly distinguishes itself from the monitoring siblings by declaring 'No monitor is created', separating it from create_monitor and provision_app.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The 'one-time' framing and 'No monitor is created' make clear this is a diagnostic pre-check rather than a monitoring setup step, and the note that cron findings 'may be supplied by the client' tells the agent when to pass them. It stops short of naming specific alternatives (create_monitor, list_monitors) or stating exclusion conditions explicitly.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.