gobuster_fuzz

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden. It discloses the core behavior (FUZZ replacement) and importantly notes that it 'Executes on remote Kali host via SSH.' However, it does not mention potential side effects (e.g., generating significant network traffic), the meaning of async, or result format, leaving some uncertainty for a complex scanning tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Three concise sentences with no redundancy. The most critical information (FUZZ replacement) is front-loaded, followed by use case and execution context. Every sentence earns its place without unnecessary filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description is adequate for a tool with 13 well-documented parameters, but it lacks information about output format or workflow (e.g., how results are returned, when to use async). Since there is no output schema, some guidance on return values would improve completeness. The description is not deficient enough to score 2, but it leaves practical gaps.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema has 100% coverage, so every parameter is already well-documented (e.g., url, headers, post_data). The description adds little beyond what the schema provides, merely summarizing that FUZZ can appear in URLs, headers, or POST data, which is already evident from parameter descriptions. Thus, baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's function: 'Fuzzing mode - replaces the FUZZ keyword in URLs, headers, or POST data with wordlist entries.' This specific verb+resource (replaces in fuzz mode) distinguishes it from sibling tools like gobuster_dir or gobuster_dns, making its purpose unmistakable.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives a clear use case: 'Useful for parameter discovery and testing.' While it doesn't explicitly name alternatives or say 'use this instead of X', the stated purpose effectively guides when to choose fuzzing over directory or DNS brute-forcing. The mention of remote Kali execution adds context for deployment.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.