subdomain_enum_active

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description must fully disclose behavior. It mentions DNS brute force and wordlist defaults but omits critical details like return format, rate limiting, error handling, or potential impact on the target. The user cannot infer what the tool outputs or how invasive it is.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise with three sentences and an example line, no redundant information. It could be more structured but is efficient and front-loads the key action.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no output schema and moderate complexity (DNS brute force), the description lacks completeness: no indication of return values, error conditions, or when to prefer passive enumeration. The example is helpful but not sufficient for a realistic use case.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema has 0% description coverage, so the description must compensate. It explains the domain parameter via examples and mentions default and custom wordlists. However, it does not define domain format (e.g., no protocol) or clarify that wordlist items are subdomain prefixes. The example partially fills the gap.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool enumerates subdomains using DNS brute force (active reconnaissance), distinguishing it from the passive sibling subdomain_enum_passive. The verb 'enumerate' and resource 'subdomains' are specific, and examples clarify usage.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies active reconnaissance but does not explicitly contrast with subdomain_enum_passive or provide when-not-to-use guidance. It gives examples but lacks context on selecting active vs passive enumeration.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.