scan_workspace

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description must carry the full burden of behavioral disclosure. It does not state whether the scan is read-only, whether it modifies files, what 'flow risks' entail, or what the return format looks like. The tool appears to be a scan, but its side effects and operational implications are opaque, which is a significant gap for a security-related tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, focused sentence with no wasted words. It leads with the action and resource, then lists the detection categories. It is efficient, though it could be improved by adding a sentence about parameters or usage without becoming verbose.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (scanning a whole workspace for multiple risk types) and the absence of an output schema and annotations, the description is insufficient. It does not explain what results are returned, how to interpret them, or the role of the include_flow parameter, leaving an agent with significant uncertainty about how to use the tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 0% schema description coverage, the description must explain each parameter, but it only indirectly references 'path' via 'local workspace' and completely omits the 'include_flow' boolean. An agent would not know what toggling 'include_flow' does or why it defaults to true. The description fails to compensate for the schema's lack of documentation.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb ('Scan'), a resource ('local workspace'), and enumerates the exact categories it detects (secrets, Korean PII, composite PII, config risks, flow risks). This clearly distinguishes it from sibling tools like scan_text or scan_diff that operate on different input types, so an agent can immediately tell what this tool is for.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage context (scanning a directory) via the phrase 'local workspace' and the required 'path' parameter, but it does not explicitly state when to choose this over alternatives like scan_text or scan_diff, nor does it mention any prerequisite conditions. The guidance is present but only implicit.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.