Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false, and the description does not contradict them. It adds behavioral context beyond annotations by specifying the returned information (title, CVE aliases, CVSS v3 score/vector, osv.dev link), the lack of search capability, and the requirement of a pre-existing advisory key.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with the core purpose, then gives return-value details, and finally addresses usage context and exclusions. Every sentence carries unique information: what it does, what it returns, when to use it, what it doesn't do, and which sibling to call instead. No filler or redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a single-parameter read-only tool with rich annotations and an output schema, the description is complete. It covers the operation, the return contents, the source of the required key, the no-search limitation, and the relationship to get_package_version. An agent can confidently select and invoke this tool without missing information.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema already fully documents advisoryKey with an example and the note about being taken from advisoryKeys, so the description doesn't need to add much. It does reinforce the source of the value and the example format ('GHSA id taken from a version's advisoryKeys'), which adds a small amount of context beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'Get a security advisory (vulnerability) by its key.' It further clarifies the scope by stating there is no search here and explicitly differentiates itself from get_package_version, which is about version-level vulnerability presence rather than deep-diving one advisory.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives explicit when-to-use guidance: 'Use this only when you already have an advisory ID from get_package_version's advisoryKeys.' It also states a clear alternative: 'To find out whether a version has vulnerabilities at all, call get_package_version first.' This leaves no ambiguity about when to select this tool versus a sibling.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.