Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, but the description compensates fully by detailing the response structure (summary, histogram, top findings), pagination with 10-minute TTL, server caps on limit, and framework awareness. This exceeds expectations for behavioral disclosure.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is comprehensive but slightly verbose; however, every sentence serves a purpose. It is well-organized and front-loaded with the core purpose.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (8 parameters, output schema exists), the description covers all necessary context: scanning scope, framework support, response shapes, pagination, and filtering. No gaps remain.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 100% schema coverage, the description adds substantial context: cursor 10-minute TTL, limit server caps, include_tests industry consensus, and shape changes triggered by min_severity/rule_filter. These details enrich the schema descriptions significantly.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description explicitly states 'Scan Go source files for payment handlers missing structured audit logging (PCI DSS 10.2.1)', providing a specific verb and resource. It clearly differentiates from sibling tools by focusing on audit logging compliance.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description advises 'Prefer this for mixed queries' and explains pagination via cursor, as well as response shape changes with filters. However, it does not explicitly mention when to use alternative tools from the sibling list.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries full burden. It discloses default response shape (summary with counts, histogram, top findings), pagination behavior, and how filters affect output. It does not mention authentication requirements, rate limits, or session cache TTL beyond 10 minutes, but covers the key behavioral aspects.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is dense but well-structured, front-loading the purpose and then detailing response shapes and filtering. Some redundancy (e.g., repeated mention of PCI DSS mappings) could be trimmed, but overall it is informative without being overly verbose.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (8 parameters, required output schema), the description adequately explains default behavior, pagination, and filter effects. It references PCI DSS mappings but does not detail the output schema structure (since it exists separately). It is complete enough for reliable invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so baseline is 3. The description adds context about combined effects (e.g., filters force flat response) and default values, but each parameter's individual purpose is already well-documented in the schema. Minor added value.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description explicitly states it scans Go source files for weak authentication, listing specific PCI DSS checks (8.3.1, 8.3.6, 8.4.2). This clearly distinguishes it from sibling tools like audit_log_coverage or check_dependencies, which target different compliance areas.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides clear guidance on when to use this tool ('Prefer this for mixed queries') and how filters (min_severity, rule_filter) change the response shape. It explains pagination with cursor and limits but does not explicitly state when not to use it or list alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description fully carries transparency. It discloses file types scanned (.go, .yaml, .json, .toml), default response shape, pagination via cursor, and effects of filter parameters. It implies read-only scanning. There is no contradiction, and the behavior is well-explained.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is detailed but not excessively verbose given the tool's complexity. It front-loads the purpose and then explains response shapes and pagination. Each sentence adds value, though some redundancy exists (e.g., mentioning response shapes multiple times). Overall well-structured.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers all essential aspects: scanning scope, file types, response shapes, pagination, filtering, and PCI DSS mapping. Since an output schema exists, the description doesn't need to detail return fields. It provides sufficient context for an AI agent to correctly invoke the tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

All 8 parameters have detailed schema descriptions (100% coverage), so baseline is 3. The description adds value by explaining how parameters like min_severity and rule_filter change the response shape from summary to flat, and clarifies pagination behavior with cursor and limit. This context goes beyond schema descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool scans for unsafe data retention patterns (CVV/PAN without TTL, missing TTL in configs, memory zeroing timing) in Go source and config files. It specifically names PCI DSS requirements, distinguishing it from sibling tools like check_secrets_in_configs or check_encryption.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides guidance on when to use this tool (prefer for mixed queries) and how to use it (pagination, filtering, response shapes). It explains the default summary response and how parameters like min_severity affect the shape. However, it does not explicitly state when not to use it or compare to specific siblings.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Given no annotations, the description covers key behaviors: bulk-downloads OSV snapshot, no module names sent (privacy), Cache TTL details, response shape defaults, and pagination. It lacks mention of auth requirements or rate limits but is otherwise thorough.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is dense and front-loaded with the purpose. It covers caching, privacy, shapes, and parameters efficiently, though some sentences could be tightened. It earns its place without redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With an output schema present, the description focuses on behavioral and usage context. It explains prerequisite, caching policy, response shape variants, pagination, and filtering. All aspects of a complex tool are addressed, making it self-sufficient for agent invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema already has 100% parameter descriptions, but the description adds critical meaning: default mode, cursor usage for pagination, limit capping, and how min_severity/rule_filter change the response shape. This goes beyond schema documentation.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool scans go.mod for vulnerabilities (PCI DSS 6.3.3). It specifies the resource ('go.mod dependencies') and action ('scan for vulnerabilities'), distinguishing it from sibling tools like update_vulnerability_db or check_tls_config.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides clear usage steps: run update_vulnerability_db first for air-gapped environments, use cursor for pagination, and apply min_severity/rule_filter for filtered responses. However, it does not explicitly contrast with other sibling tools beyond the prerequisite note.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided, so description carries full burden. It transparently explains response shapes (summary vs flat), pagination with cursor and TTL, limit cap behavior, and filtering effects. Also mentions mapping to PCI DSS standards.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Description is detailed and informative but on the longer side. It front-loads the main purpose and then structures details about response shapes and parameters. Could be slightly more concise but remains clear.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With full schema coverage and output schema present, the description thoroughly explains response shapes, pagination, and behavior under various parameter combinations. It is sufficiently complete for an AI agent to invoke correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Adds significant meaning beyond schema: cursor has 10-min TTL, limit default yields summary and warns against raising it, exclude_patterns defaults, and min_severity/rule_filter force flat response. Schema coverage is 100% but description enriches understanding.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it scans Go source files for encryption violations (weak hashes, hardcoded keys, plain HTTP URLs). It distinguishes from siblings like check_auth_strength and check_secrets_in_configs by focusing on encryption-specific issues in Go code, with unique response shape behavior.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides guidance on preferring this for mixed queries, describes when to use min_severity and rule_filter for flat responses, and explains pagination with cursor. However, it does not explicitly state when not to use this tool or mention alternatives among siblings.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Explains default response shape, effect of min_severity/rule_filter on response shape, pagination cursor TTL and usage, and server limit cap. No annotations provided, so description fully carries behavioral info.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Information-dense yet well-structured: purpose first, then behavior, then parameter-specific guidance. Could be slightly more concise but clear.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Comprehensively covers purpose, behavior, all parameters, response shapes, pagination, and filtering. Output schema exists, so return values are covered. No gaps for a scanning tool of this complexity.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema already covers all 8 parameters. Description adds extra context for limit, cursor, min_severity, rule_filter, and response shape changes, exceeding schema descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

Clearly states verb 'Scan...detects' and resource 'Go source files for payment handler error disclosure'. Distinguishes from sibling tools which cover other security checks.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides guidance on when to use defaults vs filtered responses, and pagination. However, does not explicitly mention alternative tools or when not to use this tool.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description thoroughly discloses behavioral traits beyond annotations (none provided): it describes the default summary response shape with by_severity counts, by_rule histogram, top findings, and a pagination cursor. It mentions caching with a 10-minute TTL and server caps on limit (LIMIT_EXCEEDS_PAGE_SIZE). It also notes framework awareness (net/http, gin, echo), which is critical for accurate scanning.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is dense but efficient, front-loading the core action and violations. It is a single paragraph that could be broken into sections, but it is not excessively long (about 150 words). Every sentence provides valuable information, with minimal redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (8 parameters, output schema present, diverse detection rules), the description is complete. It covers detection rules, PCI DSS mapping, framework support, response shapes, pagination, caching, server caps, and filter behavior. No gaps are evident.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Input schema has 100% parameter description coverage, so the description only adds marginal value, such as clarifying default exclude patterns and the effect of min_severity/rule_filter on response shape. Since the schema already documents each parameter adequately, a score of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it scans Go source files and HTML templates for payment page script security violations (PCI DSS 6.4.3, 11.6.1). It lists specific detection types (missing CSP headers, unsafe-inline/unsafe-eval, external scripts without SRI, inline scripts without nonce), making the tool's purpose highly specific and distinct from sibling tools like check_auth_strength or check_encryption.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description advises preferring this tool for mixed queries and explains how response shape changes with filters (min_severity / rule_filter forces flat response). It provides guidance on pagination (follow cursor) and filter usage. However, it does not explicitly state when not to use this tool or name alternatives, though the sibling list implies other tools for different checks.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries full burden. It thoroughly details response shapes (summary vs flat), pagination via cursor with TTL, page size caps, and the effects of filters. All important behaviors are disclosed.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-organized and front-loaded with purpose. It is fairly long but each sentence adds necessary context. Minor redundancy could be trimmed, but overall it's efficient.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity with multiple response shapes, pagination, and filters, the description covers all aspects including when to use default vs flat, how to paginate, and the effect of each parameter on the output. No gaps.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, but the description adds significant value beyond the schema by explaining the overall workflow, response shapes, and how parameters interact (e.g., min_severity forces flat response). It does not merely repeat schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool scans configuration files for hardcoded secrets like API keys, passwords, etc. It uses a specific verb and resource, and the purpose is distinct from sibling tools which focus on other audit areas.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explains the default response shape, how filtering changes it, and pagination behavior. It suggests using the default for mixed queries and provides guidance on filters. However, it doesn't explicitly mention when to avoid this tool in favor of siblings.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided, so description covers all behaviors: default response shape, pagination via cursor (10-minute TTL), server caps on limit, and response shape forced by filters. This is thorough for a security scanning tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is long but well-structured: starts with purpose, then details defaults and behaviors, then usage guidance. Every sentence provides necessary information, though it could be slightly more concise.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given 8 parameters, no annotations, and an output schema, the description fully covers all aspects: scanning behavior, filtering, pagination, response shapes, and PCI DSS mapping. It leaves no significant gaps.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, but description adds substantial value: explains default exclusion patterns, cursor behavior, limit cap, and how min_severity/rule_filter change the response shape. This goes well beyond the schema's basic descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool scans Go source files for TLS configuration violations, listing specific issues. It is distinct from sibling tools like check_auth_strength or check_data_retention, which target different compliance areas.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives clear guidance on when to use the default summary mode vs flat response with filters, and explains that limit should not be raised arbitrarily. However, it does not explicitly contrast with sibling tools or state when not to use this tool.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description fully carries the behavioral transparency burden. It explicitly states that it returns title, description, and testing procedure for a given requirement ID, implying no side effects.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences, front-loaded with the action, and every word is necessary. No fluff.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple lookup tool with full schema coverage and an output schema, the description covers purpose, input, and output completely. No gaps.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the baseline is 3. The description adds 'by ID' which is redundant with the parameter name and schema description. No additional meaning is added.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb 'look up' and the resource 'PCI DSS v4.0.1 requirement', and specifies the output fields (title, description, testing procedure). This distinguishes it from sibling tools which are about auditing or checking.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage when needing requirement details, but does not explicitly mention when not to use or provide alternatives. For a simple lookup tool, the context is clear.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description fully discloses behavior: default output structure, effect of filters on response shape, cursor TTL (10 minutes), taint analysis default behavior, dependency on 'go' binary, and fallback to AST-only. It details taint analysis logic (downgrading PAN-KEYWORD, suppressing PAN-TYPE) and suggests when to disable it.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured and front-loaded with purpose and usage guidance. Every sentence adds necessary information without redundancy. Despite length, it remains concise and informative.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (8 parameters, no annotations, output schema exists), the description is highly complete. It covers response shape, pagination, taint analysis details, fallback behavior, and when to use sibling tool. The output schema handles return value details, so the description focuses on high-level behavior and usage.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, but the description adds significant value: explains default path behavior, provides rationale for include_taint, warns against raising limit, describes cursor TTL, and gives usage examples for min_severity and rule_filter syntax. This enriches the schema descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool generates a 'Raw PCI DSS v4.0.1 compliance report without AI triage' for CI gates and audit artifacts, and distinguishes it from triage_findings for interactive use. The verb 'generate' and resource 'compliance report' are explicit.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides explicit guidance: 'For interactive prompts call triage_findings instead.' It explains when to use different parameters (min_severity, rule_filter, limit, cursor) and the default summary-first response vs. paginated flat list. It also warns against raising limit above server cap and describes cursor TTL.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Despite no annotations, description fully discloses behaviors: default file write, inline option with 64KB cap, cache-miss handling, compliance standard. No contradictions.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Efficiently packed with information in a logical order (purpose, defaults, overrides, inline behavior, edge cases, compliance). Every sentence adds value.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no annotations and complex functionality, description covers all key aspects: input, output, behavior, limitations, compliance. No gaps for an AI agent to misunderstand.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, and description adds significant meaning: default output path, inline size cap, UUID override, timestamp omission. Adds value beyond schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

Clearly states it generates a CycloneDX v1.6 SBOM for a Go project, with specific version and project type. Differentiates from sibling tools (other compliance/security tools) by focusing on SBOM generation.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides clear context for use (PCI DSS compliance, software inventory) and explains default behavior. Lacks explicit alternatives or when-not-to-use scenarios, but context is strong.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description fully discloses the two response shapes, the effect of parameters like min_severity/rule_filter, pagination mechanics (session cache TTL, cursor handling), performance implications of include_taint, and the server-enforced cap on limit. No contradictions.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a dense single paragraph that packs a lot of information. While efficient, it could benefit from bullet points or section breaks for easier scanning. Nonetheless, every sentence is meaningful and earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the complexity of 9 parameters and an output schema, the description covers all key aspects: default vs. flat response, filtering, pagination, performance trade-offs, and mapping to PCI DSS. It is complete for an AI agent to select and invoke the tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, but the description adds significant value by explaining default behavior, conditional response shapes, pagination details, and performance costs. For example, it clarifies that include_taint adds 5-30 seconds and that limit exceeding the page size is rejected.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool scans for PAN/CVV data exposure and provides a detailed breakdown of the default response shape (summary with counts, histogram, top findings, and pagination cursor). It distinguishes itself from sibling tools by its specific focus and behavior.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives explicit guidance on when to use default vs. filtered modes, how to follow cursors for pagination, and how to use include_tests/exclude_patterns for flat responses. It also mentions mapping to PCI DSS, providing context for compliance use.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description fully discloses behavioral traits: response shapes, pagination with cursor, parameter effects (min_severity/rule_filter on shape), limit caps, include_taint's time cost and fallback, and TTL for cursor. This goes beyond what annotations typically provide.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is dense but appropriately structured. It front-loads the main purpose, then explains default response shape and pagination, followed by parameter details. Every sentence contributes meaningful information without redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (8 parameters, no annotations, output schema present), the description covers all aspects: purpose, response shapes, pagination, parameter interactions, and caveats. It is complete and leaves no major gaps.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, but the description adds substantial meaning beyond the schema: default behavior for path, dep_scan_mode version info, include_taint effects and fallback, min_severity timing, rule_filter regex syntax, limit cap warning, and cursor TTL. Each parameter explanation adds unique value.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: running all PCI DSS v4.0.1 scanners with AI prioritization and enrichment on a Go project. It specifies the verb 'run' and resource 'Go project,' and differentiates from sibling tools (which are individual checks) by offering a comprehensive single-call triage.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides clear guidance on when to use this tool: for a full triage scan. It explains default behavior and pagination, and implicitly contrasts with sibling tools that focus on single checks. It also advises on parameter usage (e.g., limit, cursor) for fetching more findings.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description fully bears the burden of behavioral transparency. It discloses the download source (gs://osv-vulnerabilities/Go/all.zip), file size (~7.5MB), and default cache location. It does not mention whether old cache is overwritten or if the operation is atomic, but the 'fresh' keyword implies replacement.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Three sentences, each serving a distinct purpose: action, source/size, and unique differentiator with cache path. No redundant words, front-loaded with the key action.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the simplicity of the tool (one optional parameter, no annotations), the description covers the essential aspects: what it does, where data comes from, and its unique network requirement. An output schema exists, so return values need not be described. A minor gap is the lack of mention about error handling or prerequisites like internet access, but the uniqueness claim implies it.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% for the single parameter, but the description adds value by specifying the default output path and file naming pattern (go-osv-{date}.json). This provides actionable context beyond the schema's description of the parameter.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

Description clearly states the tool downloads a fresh OSV Go vulnerability snapshot to local cache for offline scanning. The phrase 'This is the ONLY tool that makes network requests' strongly differentiates it from sibling tools, many of which are audit/check tools that operate locally.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage when offline scanning is needed and when a network request is required. It explicitly says 'This is the ONLY tool that makes network requests,' guiding the agent to use it for network-dependent operations. However, it does not explicitly mention when not to use it or provide alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.