panorama_validate_ipsec_candidate

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the readOnlyHint annotation, the description discloses the validation workflow: reading all expected XPaths, checking reference resolution, and running a full candidate validation. It reinforces safety by stating that no commit or push is performed, adding useful behavioral context not present in structured annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences with no filler. The [READ-ONLY] tag is front-loaded, followed by the core behavior and then the exact scope boundary. Every sentence contributes essential information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a complex validation tool with no output schema, the description explains the validation steps but not what the caller should expect as a result, such as a success/failure response, list of errors, or exit code. It also doesn't clarify prerequisites like which candidate objects must exist. This is adequate for a basic understanding but leaves room for ambiguity.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 78%, so the input schema carries most parameter documentation. The description does not elaborate on individual parameters or their relationships, but it does not need to given the high schema coverage and the focus on validation behavior rather than parameter specifics.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states what the tool does: reads expected IPsec XPaths, verifies that references resolve, and runs a full Panorama candidate validation. It distinguishes itself from siblings by emphasizing the read-only, candidate-only scope and explicitly stating that no commit or push is performed.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides clear context for when to use this tool: validate candidate configuration before any commit or push. It does not list explicit alternatives or exclusions, such as pointing to the v2 sibling or runtime verification tools, but the 'candidate only; no commit or push' clause effectively signals the intended use.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.