patch_me_password

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations establish readOnlyHint=false (mutation) and idempotentHint=true, and the description's 'Update...' wording is consistent with those – no contradiction. But the description adds no behavioral context beyond the schema and annotations: it doesn't mention that changing a password is security-sensitive, whether a current password is required for verification, or whether existing sessions are invalidated. For a sensitive credential mutation, this is a gap, though the idempotent hint does cover one behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Four short lines: purpose, endpoint, and a single parameter note with a discovery pointer. Efficient and front-loaded. The grammar ('Update me password') is slightly awkward, and the 'Args: body' section is minimal, but nothing is redundant.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a security-sensitive mutation with a fully opaque body, the description delegates field discovery to GET/schema endpoints, which is a valid mitigation given the open payload. However, it omits context about authentication requirements, whether a current password is needed for confirmation, or any password policy constraints – details an agent would need to call this correctly. The available output schema helps but doesn't cover these semantics.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 0% schema description coverage and a body that's an open object (additionalProperties: true), the description is the only semantic source. It states 'Read the matching GET or the /schema endpoint first to see the fields this resource expects' – a genuinely useful directive that tells the agent how to resolve the opaque body instead of guessing. This meaningfully exceeds the bare schema. It stops short of enumerating expected fields (e.g., current/new password), but the discovery pointer compensates for the coverage gap.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with 'Update me password' – a specific verb and resource that clearly marks this as changing the current user's own password, distinct from patch_users_by_id (which changes other users) and patch_settings (server settings). The endpoint path is stated. It's clearly a password-update tool, but the wording is slightly informal and it doesn't explicitly differentiate from sibling tools like patch_users_by_id.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives no guidance on when to use this tool versus alternatives. It doesn't mention that patch_users_by_id handles other users' passwords, or that this specifically targets the authenticated user's own credential. There are no when/when-not conditions or exclusions – an agent must infer context from the 'me' naming convention and sibling names.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.