ako_ingress_check

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already convey readOnly, idempotent, and non-destructive behavior, so the description does not need to repeat those. It adds genuinely useful behavioral detail beyond annotations: TLS checks are skipped when secrets cannot be listed, and results are per-Ingress with OK/ISSUES status.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact and front-loaded: purpose first, then return content, then usage routing, then scope and edge-case behavior. Every sentence adds value, with no filler or repetition of schema content.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a read-only diagnostic tool with an output schema, the description covers all essential information: what is validated, what is returned, which sibling tool to use for single-Ingress analysis, prerequisite tooling, namespace scope, and a known edge case.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, with both namespace and context already documented. The description adds no parameter-level detail beyond the schema, which is acceptable because the schema carries the full burden.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('Validate') and precisely defines the resource and scope: every Ingress in one namespace, checking IngressClass and TLS secret references that would block AKO from creating a Virtual Service. It also distinguishes itself from the sibling tool ako_ingress_diagnose by clarifying it handles all Ingresses rather than one.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives explicit routing guidance: run ako_ingress_map first for namespace names and use ako_ingress_diagnose instead for a single named Ingress. It also sets clear scope expectations ('Covers one namespace only') and notes the TLS-check limitation when secrets cannot be listed.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.