issue_supervisor_kubeconfig

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Goes well beyond the annotations: discloses that the kubeconfig embeds a Supervisor bearer token acting as the configured vCenter account, that the JWT expires after hours independent of the process, and that the written file is created owner-only (0600). Annotations only say write/idempotent/non-destructive; the sensitive-credential and permission semantics come entirely from the description.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with the [WRITE] marker and the core action, then proceeds in a tight sequence: usage constraint, return shapes, token semantics, permission mode, alternative tool. Dense and mostly waste-free, though the token-lifetime parenthetical is slightly verbose.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Despite having no output schema, the description fully specifies both possible return payloads ({namespace, kubeconfig} vs {namespace, written_to}) and the credential lifetime, so an agent can handle the result safely. Nothing material is missing for a single-resource credential-issuing tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so baseline is 3, but the description adds operational meaning beyond the schema: it prescribes always passing output_path to keep the token out of agent context and explains the two return shapes that follow from that choice. It does not add anything for `target` beyond the schema text.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('issue a kubeconfig for the Supervisor K8s API') and immediately distinguishes itself from the near-namesake sibling by naming issue_tkc_kubeconfig and the cluster scope it targets. An agent can route correctly without opening either schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicit when-to-use ('Call only when the user explicitly asks for this kubeconfig'), explicit when-not ('never as a side step'), and an explicit alternative ('Use issue_tkc_kubeconfig instead to reach workloads inside a TKC cluster'). All three conditions an agent needs are stated.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.