Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the readOnlyHint annotation, it discloses a genuinely important caveat: the inventory is opt-in per cluster, so the agent must read the coverage block before concluding a package is absent. It also describes the return shape (per-row license_risk plus a facets.license_risk tier count), which matters because there is no output schema.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loads what is listed, then use cases, then filters, then the read-only note and the coverage caveat. Dense and largely earned, though the sentence about license_risk and the facets block is slightly redundant with the return-shape discussion and could be tightened.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With 13 optional params, no output schema and only a readOnly annotation, the description fills the important gaps: it explains the returned columns, the grouping level, the filtering dimensions, and the opt-in coverage caveat that guards against false negatives. An agent has enough to call it correctly and interpret results.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, including a rich enumerated description of license_risks, so the schema already carries the parameter burden and 3 is the baseline. The description's filter sentence (ecosystem, licence risk tier, cluster, namespace, image) merely summarizes filters the schema already documents in more detail, adding no new syntax or semantics.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (List) and resource (SBOM packages/components across the fleet's container images) and pins down the aggregation granularity (grouped by name, version and ecosystem) plus the columns returned. That granularity implicitly separates it from list_security_sbom_images and list_security_sbom_containers, but no sibling is named explicitly, so differentiation is inferential rather than stated.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives concrete trigger questions ("where do we run this package", "which licences do we ship", "which packages oblige us to publish source") and notes the key benefit of not needing a rescan. It does not name alternative tools or state when NOT to use this one, so it stops short of full routing guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.