List Scan Runs

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The readOnlyHint annotation covers safety, and the description adds useful behavioral context: newest-first ordering, a project-context requirement, and live progress semantics for the single-run mode. No contradiction exists between the description and annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Three sentences, each with a distinct purpose: the list behavior, the single-run alternative and its polling use case, and the prerequisite. No filler, no repetition of schema details, and key information is front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a list/single-fetch tool with fully documented parameters and a readOnly annotation, the description covers ordering, project context, alternative usage, and the polling workflow. No output schema is present, but the tool's behavior is simple enough that return-field documentation is not necessary for correct invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3. The description adds genuine value for scanRunId by linking it to the run_security_scan polling workflow and 'live progress,' going beyond the schema's note that filters are ignored. Other parameters are adequately documented by the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

States a precise verb-resource pair: 'List the security scan runs of the active project' with explicit ordering ('newest first'). It also distinguishes the single-run mode via scanRunId, making it easy to separate from the many sibling list_* tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives explicit guidance for when to use the scanRunId variant: to get a single run with live progress and to poll a scan started by run_security_scan. It also states a clear prerequisite with 'Requires project context,' so the agent knows when this tool is applicable.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.