run-command

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations only provide destructiveHint=true. The description adds substantial value: 'May modify the system' reinforces destructive nature, but more importantly it discloses the approval gate behavior (prompt, auto-allow, refusal based on approvalPolicy) and the strict single-line refusal. These are non-obvious behaviors not present in the schema or annotations. It does not describe return values or error handling, but given the tool's nature and no output schema, this is acceptable.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is tight and front-loaded: the core purpose appears first, followed by essential behavioral constraints and an alternative for a common edge case. No redundant phrases; each sentence contributes a distinct piece of information. It is concise yet comprehensive for the space it covers.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a command execution tool with 4 parameters, no output schema, and only a destructiveHint annotation, the description covers the key operational constraints (approval gate, single-line restriction) and gives an alternative for multi-line scripts. It lacks explicit differentiation from the sibling 'privileged-command' and does not describe session behavior beyond the schema, but overall it provides enough for an agent to call it correctly in most cases.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the baseline is 3. The description adds meaning to the 'command' parameter by specifying the single-line restriction, and to 'profile' by explaining that approvalPolicy on the profile decides the approval gate. It does not elaborate on 'tty' or 'session', but the schema already describes them clearly. Thus it adds some value beyond the schema, warranting a 4.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'Execute an arbitrary shell command on the remote server.' This is unambiguous and distinct from siblings like read-command (which likely reads output) and list-sessions. It also implies scope (remote server) and the generality (arbitrary command), setting it apart from more specialized tools like sftp-upload.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives clear context: single-line only, with an explicit alternative for multi-line scripts ('upload a multi-line script with sftp-upload and run it by path'). It also explains the approval gate for destructive/privileged commands, which helps decide when this tool is appropriate. However, it does not explicitly contrast with the sibling 'privileged-command' – it only mentions that privileged commands go through approval, leaving the relationship ambiguous.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.