evm_audit_contract

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the burden. It states the tool analyzes for specific vulnerabilities and gives a security score, but does not disclose whether it returns a detailed report, whether it has limitations (e.g., only certain Solidity versions), or whether any side effects (none expected). Moderate clarity.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

A single concise sentence that communicates core purpose and outputs. No fluff, but it lacks a brief note on output specifics that could enhance without much length.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With two params, no output schema, and no annotations, the description is adequate but not thorough. It explains the audit scope and output score, but does not mention the output format (e.g., JSON report), severity levels, or any limitations, leaving some agent uncertainty.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% with both parameters documented. The description adds that sourceCode must be complete and the target contract is optional, which aligns with the schema. It doesn't need to add much beyond the schema, but does note completeness requirement.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description specifies the tool audits Solidity source code for specific vulnerability types and generates a security score. It clearly distinguishes from siblings like evm_estimate_gas and evm_decode_calldata, though it lacks explicit comparison to evm_fetch_source.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage for security checking of Solidity code, but provides no guidance on when to use this versus alternatives, prerequisites (e.g., should code be compiled first), or what scenarios warrant this tool.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.