The publication change stream: what this site published, stamped with OUR publish time (first_published, kev_added, detection_added, remediation_added). Pass since (YYYY-MM-DD, strictly-after) on the first call, then the returned next_cursor to continue. Events for withdrawn CVE ids are omitted.
| Name | Required | Description | Default |
|---|---|---|---|
| type | No | ||
| limit | No | ||
| since | No | ||
| cursor | No |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the transparency burden. It discloses important behaviors such as 'strictly-after' semantics, the use of next_cursor for continuation, and that events for withdrawn CVE ids are omitted. It does not cover auth or rate limits, but these are not core for a simple stream.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is three sentences, front-loaded with the tool's purpose, followed by concise pagination instructions and an edge-case note. Every sentence earns its place with no redundancy or fluff.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's moderate complexity (pagination, time semantics, filtered events), the description covers the essential workflow. It lacks a description of the response format (no output schema) and limit defaults, but the provided details are sufficient for core usage.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must explain parameters. It explains 'since' and the cursor (via next_cursor), but does not describe 'limit' or elaborate on the 'type' enum beyond listing the values. The enum values are self-explanatory, so some weight is given, but the gap keeps this at a 3.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly defines the tool as a publication change stream, listing the specific timestamp fields it returns. This distinguishes it from sibling tools like get_cve and search_cves, which are for individual lookups or searching, not streaming changes.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It gives explicit usage instructions: 'Pass since (YYYY-MM-DD, strictly-after) on the first call, then the returned next_cursor to continue.' This is clear context for how to paginate, though it does not name alternative tools or explicitly state when to use this over them.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Add one secure layer between your agents and this server.
Each tool serves a clearly distinct purpose: get_cve retrieves a single CVE record, get_scoreboard returns a fixed report, get_updates streams publication changes, query_package filters by package, and search_cves provides full-text/structured search. There is no meaningful overlap or ambiguity in their intended use cases.
The naming follows a consistent lowercase verb_noun pattern (get_*, query_*, search_*). Three tools use 'get_' while two use 'query_' and 'search_', which are semantically distinct actions but still predictable. The deviation is minor and does not impair usability.
With 5 tools, the set is well-scoped and each tool earns its place for a CVE intelligence server. It covers retrieval, search, package-specific queries, a status report, and an update feed without redundancy or unnecessary bulk.
The tool surface covers the core workflows for CVE intelligence: single-record lookup, generalized search with filters, package-specific vulnerability queries, a high-level scoreboard report, and a change stream. No obvious gaps are visible for the stated domain.
