create_device_ipsec_phase2_interface

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full behavioral burden; it usefully discloses that omitting src_subnet/dst_subnet yields the FortiOS 0.0.0.0/0 default (a meaningful security gotcha) and that proposal/dhgrp are pass-through. But it says nothing about permissions, ADOM/device locking, commit requirements, duplicate-name handling, or idempotency for a mutation tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded one-sentence purpose followed by a well-structured arg list where each entry adds real information rather than restating the schema title. The trailing 'Returns: Creation result' is near-zero content and a small amount of trailing padding exists.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

A 14-parameter write tool with zero annotation coverage and no output-schema burden on the description (an output schema exists, so return-value detail is rightly omitted). Given that this is a network-config mutation, the absence of lock/commit/permission/conflict behavior leaves the description short of complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%, so the Args block does the heavy lifting and largely succeeds: accepted CIDR vs 'address netmask' forms with an example for src_subnet, allow/deny value sets for pfs/replay/keepalive/auto_negotiate, the 120-172800 range for keylifeseconds, and the 'root' default for vdom. The two deferred params ('pass-through, see module docstring' for proposal and dhgrp) remain unexplained since that docstring isn't available to the agent.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource with clarifying gloss ('IPsec phase2-interface (tunnel/traffic selector)') and scopes it to 'a device's device DB'. It implicitly separates from create_device_ipsec_phase1_interface by naming phase1name as the parent, though it never explicitly contrasts with update_/delete_ phase2 siblings.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is implied rather than stated: phase1name's description signals the phase1-interface must already exist as a prerequisite, and the omitted-parameter defaults tell the agent what happens when optional args are skipped. There is no explicit when-to-use versus update_device_ipsec_phase2_interface, nor any note on lock/commit prerequisites before the change takes effect.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.