Subdomains from CT logs

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Goes well beyond the annotations: the target is never contacted, names may be stale, crt.sh can take up to a minute, retries twice on 502/503, advises retrying later, and results are cached for 6h. These are exactly the operational traits an agent needs and are not derivable from readOnlyHint/idempotentHint.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loads what the tool returns, then behavioral caveats and retry guidance, in compact sentences with no filler. Every sentence carries actionable information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description correctly covers the return shape (sorted, de-duplicated names with wildcards stripped, plus matched certificate count) along with latency, failure modes, and caching. An agent has everything needed to call it and handle results.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% with a single parameter, so the schema already documents the domain argument and its URL-tolerance. The description adds nothing about parameter syntax, so baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific resource and scope - every subdomain from public TLS certificates via certificate transparency logs (crt.sh) - with no ambiguity about what is returned. The mention of dns_lookup and the wildcard/dedup handling further separate it from sibling recon tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives clear context for use and explicitly routes the agent onward to dns_lookup for resolution checks. It does not state when NOT to use it versus recon_domain or tls_certificate, but the CT-log scope makes the boundary fairly evident.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.