Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations present, the description carries the full burden and does well: it discloses that the tool opens a browser, saves the API key locally after authorization, and mentions the free tier limit of 5 scans/month. These are meaningful behavioral side effects beyond a generic 'connect account' statement.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with the core action and then adds relevant details about the flow, limitations, and alternatives. It is slightly longer than minimal, but every sentence adds useful context such as free-tier limits and env-var setup, so no sentence feels wasted.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description is complete enough for invocation: it names the trigger, the browser flow, the local key storage, and alternatives. It doesn't describe the return value or behavior if the user is already authenticated, but for a zero-parameter auth tool this is a minor gap and not likely to cause misinvocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters and full schema coverage, so there is no parameter meaning for the description to add. The description instead provides useful surrounding context about what happens during the flow, which is appropriate for a parameterless auth tool.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly identifies a specific action: connecting a CyberLens account to the MCP server. It explains the browser-based sign-up/login flow and what happens after authorization, making the tool distinct from the scanning and quota siblings.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives explicit context for when this tool is relevant and provides an alternative: users with an existing API key can set CYBERLENS_API_KEY instead. It also notes that cloud tools may launch this flow automatically, clarifying how the tool fits into automated workflows.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure. It transparently reveals a notable side effect: 'If no account is connected yet, the MCP server will launch the CyberLens browser flow automatically before checking quota.' It also lists the return values. It doesn't mention failure modes or whether the browser flow is interactive, but the key behavioral trait is disclosed.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise and well-structured: a one-sentence purpose, a clean bulleted return list, then a usage note and a behavior note. Every sentence contributes value, and the most critical information is front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a zero-parameter, no-output-schema tool, the description is complete. It states the purpose, the return data, the usage context, and the only side effect (browser flow on unauthenticated calls). An agent has everything necessary to decide to call it and understand what to expect.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool takes zero parameters, so the input schema carries no burden. The baseline for a zero-parameter tool is 4, and the description goes beyond the schema by explaining what the returned quota data includes, which helps an agent interpret the result even though the output schema is absent.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'Get your CyberLens account quota and remaining cloud scans.' It then enumerates exactly what is returned (plan name, scan usage, limits, remaining). This clearly distinguishes it from sibling scan tools like scan_website or get_scan_results, which perform different actions.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly states when to use the tool: 'Use this to confirm your account is connected and check how many cloud scans remain.' It also explains the automatic browser flow if no account is connected. However, it does not directly compare alternatives or say when NOT to use it, leaving some room for the agent to infer routing relative to siblings like connect_account.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the behavioral disclosure burden. It provides a useful behavior beyond the core function: it uses a built-in local guide library and still works when no cloud guidance endpoint is available. It also enumerates the return content, which adds transparency for an operation that has no output schema.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact and front-loaded: a one-line purpose, a bulleted return summary, and one sentence on offline behavior. Every sentence adds value and there is no redundant filler or restatement of the tool name.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description is complete for a read-only lookup tool without an output schema: it explains what the tool returns and highlights a key availability behavior. It does not cover error cases or explicitly map to a scan workflow, but the core callable context is well covered.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the baseline is 3. Both cwe_id and context already have clear schema descriptions, including examples. The tool description does not add extra parameter-level detail, but none is needed because the schema is sufficient.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'Get detailed remediation guidance for a specific vulnerability or CWE.' This clearly distinguishes the tool from the scan-oriented siblings like scan_website or get_scan_results, since none of them promise remediation instruction.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies use after identifying a vulnerability or CWE, and the sibling list shows this is the only remediation-guidance tool. However, it does not explicitly state when to prefer this over alternatives, mention prerequisites, or explain that it is meant to follow a scan.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are present, so the description carries the behavioral disclosure burden. It does well by revealing that the server will auto-connect an account first, that local scans are not eligible, and that this is for completed cloud scans. It could add more about failure modes or scan completion status, but the provided behavior is clearly disclosed.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The purpose is front-loaded and the return-value bullets are structured for easy scanning. The description is longer than strictly necessary, but each section earns its place, especially given the lack of an output schema.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema and no annotations, the description fully compensates by enumerating return contents, clarifying eligibility, and explaining the account-connect behavior. An agent has enough context to decide when to call it and what to expect from the response.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3. The description restates that scan_id comes from scan initiation and that severity_filter filters by severity, but it does not add deeper parameter meaning beyond the schema. The schema already documents defaults and allowed values, so the description adds limited extra semantic value.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific action and resource: 'Retrieve detailed findings from a completed security scan.' The return-value list makes clear this is the full-findings tool rather than get_security_score (score only) or get_remediation_guide (guidance only), so it differentiates well from siblings.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

It explicitly states when to use the tool: 'after initiating a full cloud scan with scan_website or scan_repository.' It also gives an exclusion — local quick scans do not produce a scan ID — and explains what happens when no account is connected. This is direct, actionable usage guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full behavioral burden and mostly succeeds: it frames the operation as a read ('Get... Returns') and enumerates exactly what data comes back. The main opacity is whether 'live cloud API endpoints' means the tool probes network connectivity or simply reads configured state, and no cost/latency implications are mentioned.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

A lead sentence, four dense bullets, and one usage line — every element earns its place with concrete data points. The core action is front-loaded and the itemized return list is highly scannable for an agent deciding whether to invoke it.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a single-optional-parameter read-only tool with no output schema, the description covers the return contract (four report sections) and the invocation context well. Minor gaps remain: it doesn't state whether any cloud calls are made at invocation time, how fresh the report is, or what happens when include_changelog is false, but these are not critical for correct invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the boolean include_changelog parameter is already documented in the schema. The description's 'Recent changes to the MCP scan surface' bullet loosely aligns with that parameter but adds no new syntax, default-behavior, or edge-case information beyond what the schema provides. Baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb ('Get') and resource ('honest transparency report for this MCP server'), then itemizes the four report components. It is easily distinguishable from sibling getters like get_scan_results and get_security_score because it targets the server's own behavior (version, local check inventory, live cloud endpoints, changelog) rather than scan outcomes.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The closing line gives explicit context: 'Use this to understand exactly what this server checks locally and which cloud features are live.' However, it never names alternatives or states when NOT to use it, so an agent must infer the boundary against siblings like get_account_quota or get_security_score on its own.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the behavioral disclosure burden. It explains the dual execution paths (local quick scanner vs. full cloud path), automatic fallback on quota exhaustion, and what the response includes. This is solid transparency, though it does not mention side-effect status or authentication mechanics in detail.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with the main purpose, immediately followed by a useful bulleted return summary and then the behavioral notes. It is efficient and well-structured, with no obvious filler, though slightly more verbose than strictly necessary.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given there is no output schema, the description appropriately lists the key return fields. It also covers the account/quota-dependent execution paths, which is important behavioral context. Minor gaps remain, such as not mentioning URL requirements or how to enable the cloud path via connect_account, but the tool is still adequately described for invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema already covers the single 'url' parameter at 100%, so the baseline is 3. The description adds context that the URL is for a website and that the result is a rating, but it does not add format, validation, or constraint details beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's function: 'Get a quick security rating for a website' and lists concrete outputs such as score, grade, metrics, and quick wins. It does not explicitly contrast itself with sibling tools like scan_website or get_scan_results, so it lacks explicit sibling differentiation.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives useful context about account-based behavior and quota fallback: without an account it uses the local scanner, with an account it uses the cloud path, and it falls back when quota is exhausted. However, it does not explicitly state when to choose this tool over scan_website, get_scan_results, or other siblings.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden, and it does well by stating the tool runs locally, understands skill packaging, and performs a defined set of security checks. The explicit list of threat patterns gives substantial behavioral detail. It does not describe the return behavior or whether the scan is asynchronous, but the core behavior is transparent.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is longer than average but well-structured: purpose, scope, checks, usage instruction, and examples are clearly separated. The bulleted check list is informative rather than filler. A minor reduction could improve conciseness, but the structure earns its length.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description fully explains the input and what the scan looks for, but it omits what happens after the scan: there is no mention of a scan ID, async behavior, or that results are retrieved via sibling tools like get_scan_results, get_security_score, or get_remediation_guide. With no output schema and no annotations, this missing workflow linkage is a significant gap for an agent deciding how to use the result.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema covers the single parameter fully, so the baseline is 3. The description adds value by providing concrete example URL patterns and clarifying that both hub links and direct download links are valid. This gives the agent useful format guidance beyond the plain schema text.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool scans an Open CLAW skill or plugin from CLAUDE Hub before installation, with a specific verb and resource. It enumerates concrete security checks, making its function obvious. However, it does not explicitly distinguish itself from the sibling validate_claw_skill, which could overlap in intent.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives clear timing guidance: 'Use this BEFORE installing any CLAW skill.' It also provides example URL formats for the input. It does not mention when NOT to use it or compare against alternatives like validate_claw_skill, so it stops short of full routing guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden and covers important behavior: it uses a live cloud scanner, supports only public repositories, returns a scan ID, and will trigger an account connection flow if needed. It does not mention quota usage or rate limits, but that is not essential for a first call.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with a lead sentence, bulleted source and finding lists, and a concise closing statement about behavior. It uses space efficiently and front-loads the core purpose.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no output schema and no annotations, the description covers the essential invocation context: acceptable inputs, what the scan checks, what is returned, and what happens when no account is connected. It is complete enough for an agent to call the tool and know the next step.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the input schema already explains all three parameters sufficiently. The description adds no parameter-specific details, but the baseline of 3 is appropriate because the schema handles parameter meaning.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it scans a public repository and lists the specific risk categories it checks for. It also distinguishes the target resource from siblings like scan_website and scan_claw_skill by naming repository sources explicitly.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The supported source types and the note about account connection imply when to use this tool, but there is no explicit when-not-to-use guidance or comparison with sibling tools. The mention of get_scan_results as the follow-up step provides useful workflow context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

There are no annotations, so the description carries the full behavioral burden. It discloses the quota fallback action, the difference between local and cloud checks, and that the cloud path returns a scan ID. It does not state the local scan return format, but the main side effects and mode behaviors are covered.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured into three short paragraphs, front-loads the purpose, and every sentence adds necessary conditional or output information. There is no filler or repetition.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool has conditional behavior, no output schema, and a nested parameter, but the description covers the main paths: local vs cloud, quota fallback, and scan ID routing. The local quick scan's return format and the full database flow are left implicit, a minor gap given the schema already documents the parameters.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents url, scan_type, and database_connection. The description adds mode-level context but does not materially extend parameter meaning beyond what the schema provides.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The first line states a specific action and resource: scan a website for security vulnerabilities. It clearly distinguishes website scanning from sibling tools like scan_repository and scan_claw_skill, and further explains the two execution modes.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives concrete usage context: without an account use local quick scan; with an account use full cloud scan; on quota exhaustion it falls back. It does not explicitly name alternatives, but the conditional guidance is sufficient for an agent to decide when to invoke this tool.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the behavioral burden. It discloses what the validation covers (manifest structure, permission scopes, external dependencies, filesystem access, env vars, plugin isolation), but it does not state whether the operation is read-only, what it returns, or whether it contacts external services.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with the core purpose, followed by a scannable bullet list of checks and a single usage sentence. Every line earns its place with no repetition or fluff.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

It gives enough to understand input and purpose, but with no output schema it should describe what the caller receives (e.g., pass/fail, findings list, score). The optional skill_code parameter and deeper analysis behavior are only in the schema, not integrated into the narrative.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the schema documents both parameters. The description adds context about what is being validated but no additional parameter-level meaning beyond the schema's existing descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a specific action (Validate) and a precise resource (CLAW skill manifest and configuration), with a list of concrete security checks. It does not explicitly contrast itself with the sibling scan_claw_skill, so it is clear but not fully differentiated.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

It states explicit use cases: before publishing to CLAUDE Hub and for CI/CD validation. It provides no when-not-to-use or direct alternative routing, but the intended contexts are clear.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.