scan_domain

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full behavioral burden. It discloses the authorization precondition, but says nothing about what happens when authorized=false (refusal, error, degraded result), whether the call is read-only and non-intrusive, whether it makes external network requests, rate limits, or how the many opaque feed inputs (KEV, OSV, STIX) are consumed.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

A single sentence with zero wasted words and the key constraint front-loaded, so structurally fine. But the brevity comes at the cost of under-specification for a 12-parameter tool, so it reads as thin rather than tight.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return values need not be explained. However, for a tool with 12 parameters, several opaque nested feed objects, and no annotations, one sentence leaves an agent without enough context to populate the inputs or predict behavior.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

12 parameters at 0% schema description coverage, and the description explains none of them. It implicitly gestures at the 'authorized' flag but never names it or states its required value, and gives zero meaning for max_assets, kev_catalog, osv_results, stix_bundle, or the observation objects.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

States a verb-and-resource ('query public sources for a domain'), but 'public sources' is vague about what is actually collected (assets, vulnerabilities, threat intel), and the tool name 'scan_domain' suggests scanning behavior the description never confirms. No differentiation from the sibling analyze_snapshot.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides one explicit gating condition ('only when the user explicitly confirms authorization'), which is a real usage constraint. But it offers no when-not guidance beyond that, no relation to analyze_snapshot, and no indication of what to do instead when authorization is absent.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.