Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the burden. It states what it detects (high-entropy API keys, private keys, tokens) but doesn't disclose whether it modifies anything, whether it scans a repo/path/string, or what the output format is. It's a scanner, so it's likely read-only, but that's not explicitly stated.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

One sentence, front-loaded with the key terms, no waste. It earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 0-param tool with no output schema, the description is mostly complete. However, it doesn't specify the input source (e.g., does it scan a file, a repo, a code snippet?) or the output format. An agent might not know how to invoke it without that context.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has 0 parameters, so the schema is trivial. The description adds meaning by specifying what the scanner looks for, which is the only semantic content needed. Baseline 4 for 0 params is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('scans') and names the resource ('code') plus the target artifacts ('API key, private key, and token leak'). It clearly distinguishes itself from the sibling tools, which are about contract risk, arbitrage, markdown, etc. It doesn't explicitly name the sibling it is not, but the resource and target are specific enough.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies the tool is for scanning code for secrets, but it doesn't state when to use it vs alternatives or any exclusions. There are no sibling tools that do secret scanning, so the context is clear enough, but no explicit guidance is given.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.