analyze_prompt

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already cover the safety profile (readOnly, idempotent, non-destructive, closed-world), yet the description still adds real behavioral context the annotations cannot: it runs locally, it only egresses to the cloud gate when ZN_CLOUD=1 and ZN_API_KEY are set, and secrets are redacted before transmission. That data-flow disclosure is exactly what an agent needs before sending sensitive prompts. The sentence is syntactically mangled ('ZN_API_KEY is the text, with secrets redacted, also sent to...'), which blunts the disclosure somewhat.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with the detection scope, which is correct, and there is little fat. However, the second sentence crams the local/cloud routing, env-var condition, redaction, and return shape into one run-on clause that is grammatically broken and forces re-reading.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Compensates well for the absent output schema by naming the return payload (threat assessment, confidence score, matched rule), and discloses the privacy/data-flow model. Remaining gaps are minor for a single-string read-only tool: no severity thresholds, no guidance on acting on a low-confidence match.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

One parameter with 100% schema coverage, so the schema already defines 'text' fully; baseline is 3. The description adds marginal value by broadening the accepted input to 'text, prompt, or agent messages', but gives no length limits, encoding expectations, or guidance on chunking large inputs.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

Names a specific verb (analyze/check) and resource (text, prompt, agent messages) and enumerates the exact threat classes it detects: prompt injection, jailbreak, credential exfiltration, role hijacking. Sibling differentiation is only implicit — the scope wording implies it handles free text rather than tool calls/results, but check_tool_call and check_tool_result are never named, so an agent must infer the boundary.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is implied by the resource description (analyze standalone text rather than a tool call or tool result), but there is no explicit 'use this when / use X instead' routing, no prerequisites, and no statement about whether it should be run on every inbound message or only on untrusted input.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.