Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden and does reasonably well: it discloses that repository code is never executed and that findings are heuristic and explicitly not guaranteed to be correct or complete. It omits permission requirements, performance/scope limits beyond 'bounded', and pagination behavior implied by limit/offset.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Three short sentences, front-loaded with purpose, then behavior, then caveat. No filler and every sentence supplies information the schema or annotations do not.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a no-annotation, no-output-schema tool with undocumented parameters, the description covers purpose and reliability caveats but says nothing about how findings are returned, what 'supported source files' means, or how limit/offset shape results. Adequate but with real gaps.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% and none of the three parameters (path, limit, offset) are explained in the description. 'Supported source files' loosely implies path scope and 'bounded' loosely implies limit, but the description adds almost no usable semantics over the bare schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource: runs bounded local heuristics over supported source files and returns possible defects and security risks. Clear and concrete, but it never distinguishes itself from overlapping siblings like scan_project or review_security, so an agent must infer which analyzer to pick.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no when-to-use guidance and no routing to alternatives, despite four sibling review/scan tools that plausibly overlap. The phrase 'supported source files' hints at a supported-file restriction but never says what is unsupported or when another tool is preferable.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden and does a good job: it discloses that output is bounded, that nothing is written to disk, and that source contents and secret values are excluded from findings. This is meaningful safety/privacy behavior an agent could not get from structured fields. It stops short of explaining whether the tool itself performs scanning or only formats results, which is the remaining behavioral unknown.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Three dense sentences, front-loaded with the verb and no filler; each sentence contributes a distinct fact (purpose/format, no-file-write, findings content). Slightly list-like, but nothing is wasted.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 3-parameter tool with no output schema, the description supplies useful return-content detail (evidence, uncertainty, exclusion of secrets), which partially substitutes for a missing output schema. However, the unexplained `path` parameter and the absence of any when-to-use context leave real gaps for correct invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% for all three parameters. The description covers `format` incidentally ("Markdown or JSON") and hints at bounding, which loosely maps to `limit`, but `path` is never explained — an agent cannot tell whether it is a directory to audit, a report destination, or something else. Two of three parameters remain semantically opaque.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (Generate) and resource (audit report), plus the two output formats and that the report lands in the tool response rather than a file. It implicitly separates itself from scanning/review siblings by being a reporting step, but never names an alternative tool, so the differentiation is left to inference.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no explicit guidance on when to call this versus scan_project, review_security, or the other six siblings, nor any stated prerequisite (e.g., that a scan must run first). A reader can infer it is the aggregation/reporting step, but nothing in the text confirms that.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full behavioral burden. It usefully discloses that results are heuristic, that middleware may fall outside scope, and that verification is required — real limitations. But it omits whether the tool is read-only, what 'supported' backends/languages are, and how results are presented, leaving meaningful gaps for a code-review operation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Two tightly written sentences with the scope and risk list front-loaded and the caveat placed last where it belongs. Nothing is redundant, though 'supported backend source' is a slightly vague qualifier that costs a little precision.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 3-parameter review tool with no annotations and no output schema, the description covers scope and caveats but says nothing about parameter usage, what findings look like, or how pagination works. An agent can pick the tool but not confidently invoke it.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% and there are three parameters (path, limit, offset), all undocumented in both schema and description. The description gives no indication that 'path' scopes the review or that limit/offset paginate it, so an agent must guess that pagination even exists.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb ('Review') and resource ('backend source') and enumerates the risk classes it inspects: route authorization, query construction, error handling, configuration. It distinguishes itself loosely from review_frontend by scope, but never names or contrasts siblings like review_security, which overlaps the same risk territory.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is implied by the backend/frontend split in the sibling set, and the closing caveat signals that findings are heuristic and need verification. However there is no explicit when-to-use statement, no condition for choosing this over review_security, and no prerequisites for invocation.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden. It usefully discloses that analysis is static-heuristic only and therefore requires context/data-sanitization verification, which tells the agent results are provisional. However, it says nothing about read-only/side-effect behavior, permissions, or what the review actually inspects.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Two tight sentences, front-loaded with the action and scope, with zero filler. The trailing 'verify context and data sanitization' is slightly terse to the point of ambiguity, keeping it just shy of a 5.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

No annotations, no output schema, and three undocumented parameters: the agent is left guessing at path resolution, paging behavior, and the shape of the review output. For a 3-parameter tool with no structured support, the description does not fill enough of the gap.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% for three parameters (path, limit, offset), so the description must compensate and does not. It is silent on how path resolves against 'discovered' source and on the pagination semantics of limit/offset.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (review) and resource (discovered frontend source) plus the risk scope (UI behavior and rendering risks). 'Frontend' implicitly separates it from review_backend, but it never explicitly names or contrasts with any sibling such as review_security or analyze_code.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

No statement of when to choose this tool over review_backend, review_security, analyze_code, or scan_project, and no prerequisites. 'Static heuristics only' hints at a limitation but does not tell the agent which situations warrant this review versus an alternative.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden and does well on the trust dimension: it explicitly promises that secret file contents are never read or returned, and it bounds its own coverage by disclaiming a full audit. It leaves unstated whether the operation is read-only and how findings are surfaced.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Three sentences, all load-bearing: scope first, trust guarantee second, limitation third. No filler and no repetition of the tool name.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a scanner with no output schema and a zero-coverage input schema, the description covers scope and data-handling but says nothing about the shape or volume of results (how findings are listed, whether severity is included). It is adequate but not complete for an agent deciding how to consume the output.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% and none of the three parameters (path, limit, offset) are mentioned in the description. The names are conventional, but nothing clarifies that path defaults to the current directory or that limit/offset paginate findings, so the description does not compensate for the coverage gap.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb ('Check') and enumerates the exact classes of findings it produces (credential-shaped values, dynamic code execution, raw HTML insertion, backend risks), so an agent knows this is a static security scan. It partially distinguishes itself from review_backend by scoping to 'selected backend risks', but never names the sibling explicitly.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is implied by the enumerated check categories, and there is one useful exclusion ('This is not a full security audit'). However, it never says when to prefer this over scan_project, analyze_code, or review_backend, which overlap heavily with a security-scanning tool.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full behavioral burden. It does disclose that the tool is non-executing and read-only in effect, which is valuable safety context, but says nothing about required permissions, whether results are paginated, or what a 'no tests found' outcome looks like beyond the passing mention.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short, front-loaded sentences with no filler. The second sentence is a useful scope boundary rather than padding, though the 'identify when none are found' clause is slightly redundant with the discovery verb.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a search tool with three undocumented parameters and no output schema, the description omits critical calling information: what 'path' scopes, how limit/offset paginate results, and what the tool returns. An agent could invoke it, but not confidently or correctly for large repositories.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% and the description mentions none of the three parameters. The meaning of 'path' (root to search?), and especially 'limit'/'offset' as pagination controls with their defaults and caps, is left entirely undocumented in both schema and description.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource: discovering test files. The negative clause ('Does not run project tests, install packages, or execute scripts') helps distinguish it from action-oriented siblings like analyze_code. However, it does not distinguish itself from scan_project, which plausibly also discovers files, and 'identify when none are found' is an awkward restatement of returning an empty result.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description supplies negative guidance (does not run tests, install packages, or execute scripts), which usefully rules out misrouting. But it never states when to prefer this tool, what prerequisites exist, or which sibling to use instead for adjacent tasks.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden; it does disclose the safety profile ("Read-only") and that results are paginated, which are real behavioral facts. It omits permissions/auth requirements, rate limits, and what governs which files get counted as skipped.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Three short sentences with no filler: scope first, then the read-only safety fact, then the path constraint and pagination. Everything is front-loaded and each sentence earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no annotations and no output schema, the description is the only source of behavioral context. It covers scope, safety, and pagination, but leaves the return shape (what a manifest record or inventory entry looks like) and page-size behavior unstated.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate for all three parameters. It adds real meaning for `path` (relative subdirectory only, scoped to the configured workspace) and hints at pagination, but `limit` and `offset` are never addressed by name, units, or bounds.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description gives a specific verb ("Discover") plus a concrete resource inventory: project manifests, frameworks, source file inventory, and skipped-file counts under the workspace. That clearly distinguishes it from the review_*/analyze_* siblings, which analyze rather than inventory, though no sibling is named explicitly.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

It adds a constraint on how to use `path` (relative subdirectory only) and notes pagination, but never states when this tool should be chosen over analyze_code or the review_* tools, nor any prerequisites for a successful scan.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden and does disclose important behavioral limits: it only handles static/literal paths and does not prove connectivity. It still omits whether the operation is read-only, how pagination behaves, and what the result shape looks like.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Three tight sentences with the core capability front-loaded and the caveats last. Every sentence contributes; no filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a static-analysis tool with no output schema and no annotations, the description usefully characterizes the output (file/line evidence, mismatch reports) but leaves pagination and path scoping unexplained, so an agent cannot fully predict invocation behavior.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% across three parameters (path, limit, offset), and the description adds nothing about scoping the scan root or the pagination limits. An agent must guess that limit/offset paginate and that path is a filesystem root.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a specific verb+resource pair (list frontend request calls and backend Express route declarations) and adds the evidence granularity (file and line). It is clearly distinguishable from review_frontend/review_backend in intent, though it never names a sibling to route against.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to choose this over scan_project or the review_* tools. The closing sentence scopes capability boundaries (dynamic URLs, connectivity proofs) but that is a limitation statement, not a when-to-use condition or an alternative.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.