lazaretto

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the readOnly/idempotent/destructive annotations, the description adds valuable behavioral detail: the call is free and anonymous, one call covers the whole tree, and results fail closed with unverified entries so that an empty malicious list alone is not an all-clear. It also warns about the exact-version limitation, which is essential for interpreting results.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise yet dense, with each sentence serving a purpose: what it checks, what it accepts, the exact-version limitation, and the fail-closed result interpretation. The key information is front-loaded, and there is no filler or redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a single-parameter read-only tool with an output schema, the description provides all necessary context: input format, limitation, service characteristics, and how to interpret results. Any remaining return-value details are covered by the output schema, so nothing critical is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The single parameter has 100% schema description coverage, so the baseline is 3. The description adds meaningful semantics about accepted lockfile formats and the exact-version requirement that tells an agent what kind of content is expected and what its limitations are, going slightly beyond the schema's purely syntactic description.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('Check') and resource ('every EXACTLY-PINNED dependency in a lockfile') against published advisories, and specifies the accepted lockfile formats. It clearly distinguishes the tool from artifact scanning or attestation siblings by focusing on lockfile contents and malware advisories.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides clear operational constraints: only exact-pinned versions can be answered, and range specs are not definitive. It also explains the fail-closed interpretation of the results. However, it does not explicitly name sibling tools or state when to choose one over another, so the routing guidance is implied rather than fully explicit.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations provide idempotentHint=true and destructiveHint=false, but the description adds significant behavioral detail: it makes no network call, is 'metered like scan_artifact' (indicating a cost), and detects specific threat types (tool poisoning, hidden directives, etc.). It also warns that it applies the same rules as scan_mcp_server, preventing false assurance. This goes beyond the annotations without contradicting them.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact and front-loaded: first states the core purpose, then the rationale, then the input format, then the analysis scope and metering. Every sentence adds value, though it packs a lot of information into five sentences. It could be slightly more terse, but the structured flow makes it easy to parse.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a single-parameter tool with an output schema, the description covers everything needed: the input format, the local-only behavior, the detection capabilities, the metering, and the relationship to scan_mcp_server. No crucial information is missing, and the output schema handles return values.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents the parameter thoroughly. The description's mention of 'a whole tools/list response, a {...} object, or a bare array' exactly mirrors the schema text, adding no new information. Baseline 3 applies because the schema carries the full semantic load.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description starts with a clear verb and resource: 'Check tool definitions you ALREADY HOLD, with no network call to anyone.' It explicitly distinguishes from scan_mcp_server by noting it analyzes the same text but requires no network, making the tool's unique scope obvious.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explains when to use this tool: when you already have the tool definitions locally and cannot reach the server over the network ('Most MCP servers run locally over stdio and have no endpoint... this is the only way to check them'). It also references scan_mcp_server as the counterpart, implying that server is used when network access is possible. It doesn't explicitly state 'use scan_mcp_server for network scanning,' but the context makes it clear.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description adds significant behavioral context beyond the annotations. It discloses that the tool is free and anonymous (not in annotations), describes the return value (signed verdict) and its verifiability, explains freshness indicators (corpus contradiction and older rules version), and clarifies the meaning of a miss. This aligns with and enriches the openWorldHint and readOnlyHint annotations without contradiction.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise and well-organized, with the core purpose front-loaded in the first sentence. Each sentence adds meaningful information (usage timing, input types, return details, miss semantics) with no fluff. While it is a single paragraph of moderate length, every part contributes to agent understanding, so it is appropriately sized.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool has only one parameter, rich annotations, and an existing output schema, the description is remarkably complete. It covers what the tool does, what to pass, what to expect in return (including freshness details), and the meaning of a miss. An agent can correctly invoke this tool and interpret the response without ambiguity.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema already describes the subject parameter with 100% coverage, including an example. The description goes further by enumerating the valid input forms (package identity, MCP server URL, or sha256 hash) and noting the optional 'sha256:' prefix, which is not in the schema. This adds practical guidance that helps the agent format the input correctly.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: to ask whether anyone has already attested an artifact. It specifies the resource (attestation) and provides clear guidance on input types (package identity, MCP server URL, or hash). It differentiates from siblings by emphasizing it is free, anonymous, and should be used before scanning – making it distinct from the scan_* and check_lockfile tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives explicit timing guidance ('BEFORE you install it or pay to scan it') and clarifies the tool is free and anonymous, which implies using it as a pre-check. It also explains that a miss is not a verdict, preventing misuse as a safety check. However, it does not name specific alternative tools or explicitly state when not to use it beyond the pre-scan context, so it is strong but not exhaustive.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, openWorldHint=true, idempotentHint=true, and destructiveHint=false, so the description does not need to repeat those. It adds valuable behavioral context by stating the indicator set is refreshed daily from abuse.ch and, crucially, that a miss is not a clean verdict on the artifact. This goes beyond the annotations by explaining interpretation semantics.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences long, front-loads the core action and resource, and wastes no words. Every sentence adds value: the first establishes what the tool does, the second clarifies an important interpretation caveat. This is exemplary conciseness.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple one-parameter lookup tool with a rich annotation set and an output schema (not shown but indicated), the description is complete. It covers the essential behavioral nuance (miss ≠ clean verdict) and the data freshness. Nothing an agent needs to correctly invoke the tool is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% for the single parameter (sha256), which fully documents the format and optional prefix. The description adds no additional information about the parameter, but given the high coverage, a baseline of 3 is appropriate. No extra semantic value is provided beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb 'Check', the resource 'SHA-256 against Lazaretto's known-bad indicator set', and adds important context about being free and anonymous. It also clarifies the meaning of a miss. However, it does not explicitly differentiate from sibling tools like scan_artifact or check_lockfile, so it falls short of a 5.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage: you would use this to quickly check a hash against a known-bad list, and the 'free and anonymous' note hints at when this tool is appropriate. However, it does not explicitly state when to use this versus alternatives, nor does it mention any exclusions or prerequisites. The guidance is implicit rather than explicit.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description goes beyond the sparse annotations by disclosing that this is a paid/external operation, how to authenticate or pay, and the deterministic verdict/evidence/hash contract. It adds the billing, wallet, and free-trial context that the annotation fields alone cannot express, and nothing in the description contradicts the annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is dense but well structured: the first sentence defines behavior and output, the second covers billing and authentication, and the third routes to free alternatives. Every sentence earns its place and the core action is front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the input schema covers all parameters and an output schema exists, the description fills the remaining operational gaps: metering, key/wallet auth, free trial, and when not to use this tool. An agent has enough information to call it correctly and to decide whether it should call it at all.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents all four parameters. The description adds little parameter-level meaning beyond mirroring the artifact categories, so it neither harms nor meaningfully compensates at this dimension.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'Deterministically analyze a package, repo, skill, or file for malicious behavior' and enumerates concrete threat classes and the exact verdict/evidence/hash output. It also names the free sibling tools check_lockfile and known_bad_lookup, distinguishing this metered full scan from those alternatives.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

It states the cost model and authentication requirements upfront ('Metered: present an X-API-Key holding credits', wallet alternative, $0.03 per call) and closes with an explicit routing rule: 'For checks that are always free, use check_lockfile or known_bad_lookup.' This tells an agent both when to incur the metered call and when to select a cheaper sibling instead.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond annotations, the description discloses concrete behavioral details: it reads package code, reports specific threat categories with evidence, charges one credit per verdict, charges nothing for errors, and caps at 25 packages. This goes well beyond what readOnlyHint, openWorldHint, idempotentHint, and destructiveHint communicate.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with a precise, high-signal first sentence, followed by metering details and a practical usage directive. Every sentence contributes new information, with no redundancy or filler despite the richness of content.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the output schema exists, the description covers everything an agent needs: what the tool does, what the input is, cost model, error charging behavior, limit, how it differs from the primary sibling, and when to invoke it. No critical operational context is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, and the lockfile parameter is already described as the full text contents of supported lockfile formats. The tool description does not add new parameter-level semantics, so the baseline of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb and resource: "Behaviorally scan EVERY exactly-pinned dependency in a lockfile." It clearly distinguishes this tool from check_lockfile by explaining it reads package code and reports specific threat categories with file-and-line evidence, rather than just matching names and versions.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly names check_lockfile as the cheaper advisory-only alternative, characterizes this tool as its paid counterpart, and gives a direct use case: "Use it before installing a tree you have not vetted." It also states metering and package caps, which are practical when/when-not signals.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations (readOnlyHint=false, idempotentHint=false, openWorldHint=true, destructiveHint=false) already signal an external side-effecting call, and the description aligns rather than contradicts. It adds substantial context beyond annotations: the tool makes an outbound network request and analyzes whatever text the server returns, the verdict is bound to a hash so a server that later changes its tools cannot inherit an old clean verdict, and the call is metered with explicit cost and endpoint details. This is rich behavioral disclosure that materially affects how an agent should use the result.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is dense but front-loaded: the core purpose and usage trigger occupy the first sentence, followed by mechanism, detection categories, return shape, and metering. The pricing details ($0.03 USDC, endpoint path, target type) are slightly beyond what is needed for tool selection, but they are legitimate operational context for a paid tool. Every sentence earns its place; the only cost is length.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool of this complexity — an outbound scanner with hash-bound verdicts — the description covers purpose, mechanism, output shape (verdict, evidence line, hash), threat categories, and cost. The output schema exists, so return values need not be fully re-explained. The only notable gap is failure behavior (unreachable servers, non-MCP endpoints, timeouts), which is minor given how much else is disclosed and the presence of structured schemas.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% for the single required `url` parameter, so the schema already documents it and the baseline is 3. The description adds only marginal parameter context — the url is the MCP server endpoint to check before connecting — and does not give format constraints beyond what the schema presumably provides. It does not compensate or contradict, landing at the baseline.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource — "Check an MCP server BEFORE you connect to it" — then explains the mechanism (ask the server to introduce itself and list tools, analyze the returned text) and enumerates the specific threats detected (tool poisoning, secret-exfiltration parameters, cross-server shadowing, invisible unicode). This is clearly distinguished from the lockfile/attestation siblings by domain and from scan_artifact by target type, so an agent can pick it correctly without opening the schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

"BEFORE you connect to it" gives an explicit temporal trigger for when this tool should be called, and the threat list tells the agent what kinds of servers warrant scanning. It does not, however, name when-not-to-use conditions or route to an alternative for the same task — scan_artifact is mentioned only for metering parity, not as a decision point. Clear context without exclusions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false. The description adds meaningful behavior beyond that: it discloses it is 'Free and anonymous', details the return fields (signature validity, claims, and the 'contradicted' flag semantics), and warns about a required verification step. This goes beyond what annotations alone provide.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is dense but efficient, front-loading the core purpose and key constraint ('WITHOUT re-scanning or paying') before explaining returns and the required follow-up. Every sentence adds value; no fluff or redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given an output schema exists (which presumably details return values), the description covers all essential context: when to use it, what it returns, a critical usage caveat (confirming claims.sub), and the free/anonymous nature. Nothing an agent needs to call it correctly is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%; the schema describes the parameter as 'The compact-JWS attestation string from a scan report.' The description adds only the nuance that the attestation may come from 'another agent (or a README, or a lockfile)', which is minor. Baseline 3 is appropriate since the schema already documents the parameter.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb ('Verify') and resource ('Lazaretto scan attestation'), and immediately clarifies scope: 'WITHOUT re-scanning or paying' distinguishes it from scan_artifact. It also explains exactly what it returns, making the purpose unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Context is explicit: it's for attestations 'another agent (or a README, or a lockfile) handed you', and it explicitly says 'WITHOUT re-scanning' implying you'd use a scanning tool otherwise. It also gives a mandatory follow-up action ('You MUST still confirm...'). It doesn't name sibling alternatives by name, but the guidance is clear enough.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.