scan_diff

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden. It discloses that only added lines are scanned and that findings have correct line numbers and file paths, which suggests a focused behavior on additions and accurate location mapping. However, it does not mention side effects, authorization needs, rate limits, or what happens to unchanged lines, so while useful, it could be more transparent.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences long, conveying purpose, input type, and key behavior without any filler. It is efficient and front-loaded with the actionable verb and main subject.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool has only one parameter, no output schema, and no annotations, so the description provides sufficient completeness for its simplicity. It explains what is scanned and the quality of results. However, given the sensitive nature of vulnerability scanning, noting typical output format or limitations would improve completeness slightly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 100% coverage with a single parameter 'diff' described as 'Unified diff text (e.g. from git diff).' The description adds that the diff should be from git etc., and mentions scanning only added lines, but does not add formatting details or constraints beyond the schema. Since schema coverage is high, baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool scans a unified diff for vulnerabilities, which is a specific verb-resource combination. It distinguishes itself from sibling tools like scan_file or scan_code by focusing on diff input, and it clarifies that only added lines are scanned, which is unique among the siblings.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies when to use this tool: when you have a unified diff (e.g., from git diff) and want to scan for vulnerabilities. It provides context on what is scanned (only added lines) and correct output assignments, but does not explicitly mention when not to use it or suggest alternatives among siblings, so the guidance is good but not comprehensive.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.