Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full behavioral disclosure burden and does it well. It reveals that associations are name-based against the CPE, that results are pointers rather than findings, and that an empty result does not imply the module is unaffected. The statistical context (16 of 5,504 certificates) manages user expectations about data sparsity.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Three sentences with zero filler. The first sentence states the core function, the second frames the typical use case, and the third adds essential caveats about result interpretation. Information is front-loaded and every sentence earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no annotations and no output schema, the description covers the most critical behavioral context: name-based matching, empty-result semantics, and data sparsity. It does not explain return format or how combined cve+vendor queries behave, but the tool's purpose and limitations are largely complete for a lookup tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is only 50%, and the description compensates partially by explaining the role of the cve and vendor parameters in the two lookup directions. However, limit and min_cvss are not addressed in the description and have no schema descriptions, leaving a meaningful gap for two of the four parameters.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a clear bidirectional lookup: FIPS-validated modules for a CVE, or CVEs for a vendor's modules. The use case 'we have a validated module, is it caught up in this advisory' makes the tool's purpose instantly understandable and distinguishes it from sibling tools like fips_search or fips_vendor.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives clear context for when to use this tool: answering whether a validated module is affected by an advisory. It does not explicitly name alternatives or exclusion criteria, but the intended scenario is concrete and actionable.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.