zap_spider

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden of behavioral disclosure. It mentions that OWASP ZAP must be running and requires environment variables, but it does not state whether the crawl is a read-only operation, potential side effects (e.g., sending requests to target), time expectations, or what happens on failure. This is a significant gap for a tool that actively interacts with a target.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with a summary, args, returns, and note sections. It is appropriately sized and front-loaded with the main purpose. Minor redundancy exists between the first two sentences ('Spider/crawl...' and 'Discovers all links...'), preventing a perfect score.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool is a crawler with four parameters and an output schema, and the description covers its basic purpose, prerequisites, and parameter defaults. However, it lacks information about error handling, failure modes (e.g., if ZAP is unreachable), and any caveats about crawl behavior. While the output schema likely covers return values, the description doesn't provide enough context for an agent to fully understand the tool's operational bounds.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate. It provides explanations for max_depth (default 5), wait_for_completion (wait for spider to finish), and timeout (override scan timeout in seconds). However, it does not explain the URL format or behaviors when timeout is null or when wait_for_completion is false. The parameter semantics are adequate but not comprehensive.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's function: spider/crawl a web application using OWASP ZAP, discovering links and URLs. It identifies the specific resource (OWASP ZAP) and the action, and notes it's typically the first step before an active scan. However, it doesn't explicitly differentiate from other spider/crawl tools like katana_crawl or feroxbuster_scan, so it's not a 5.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides clear usage context: 'This is typically the first step before an active scan,' which implies using it before zap_active_scan. It also lists prerequisites (ZAP running, environment variables). It doesn't explicitly mention when to use alternatives or when not to use this tool, so it falls short of a 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.