security_audit

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description must disclose behavioral traits. It does list the vulnerability types covered, which adds meaningful context about what the audit checks. However, it does not state whether the tool modifies code, its output format, limitations, or side effects. 'Audit' implies read-only, but this is not explicit.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, well-structured sentence. It front-loads the verb and resource, then compresses the vulnerability list efficiently. Every word adds value, and there is no redundant or filler text.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (security auditor) and lack of annotations/output schema, the description is incomplete. It omits the return format (e.g., list of findings with severity), whether the tool is safe/read-only, and any limitations (e.g., static analysis only, false positives, version-specific checks). The user gets enough to select the tool but not to predict its full behavior.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 50%; code is described as 'Code to audit' and fileType has an enum with no description. The tool description does not explain the fileType options (php, blade, model, component, routes) or how they affect the audit. It adds context about vulnerability categories but not about the parameters themselves.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description starts with a specific verb ('Audit') and resource ('Livewire 4.2.1/Laravel 13.2 code'), then enumerates precise vulnerability categories (XSS, SQL injection, mass assignment, etc.). This clearly distinguishes it from sibling bug-scanning tools like scan_project_bugs or deep_scan_bugs by focusing specifically on security vulnerabilities.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies when to use the tool: when you need a security audit of Livewire/Laravel code. However, it provides no explicit guidance about alternatives, exclusions (e.g., non-security issues, other framework versions), or when not to use it. The context is present but implicit.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.