security-intel-mcp

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided, so description carries full burden. Discloses return type (per-package findings and summary) and default ecosystem. No side effects or destructive behavior, so adequate transparency.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, front-loaded with action verb, no wasted words. Efficiently conveys tool's purpose and input options.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

No output schema, but description mentions return type generically. With 100% param coverage and clear purpose, it is mostly complete. Could specify output structure more precisely.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, and description adds clarity by explaining that 'manifest' is raw package.json, 'dependencies' is array of {name, version} objects, and ecosystem defaults to npm.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

Clearly states the tool audits a dependency manifest for known vulnerabilities, distinguishing it from siblings that handle individual lookups. Specifies input formats and output summary.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Describes two input methods (manifest string or dependencies array) and that it's for a batch audit 'in one call'. No explicit exclusion of when not to use, but context implies usage for whole manifests.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries full burden. It discloses the data source (NVD/NIST) and the nature of the operation (lookup, no side effects). It does not detail rate limits or error handling, but for a read-only lookup, this is acceptable.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single concise sentence that immediately conveys the tool's purpose and output. No wasted words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the simple input (one string) and no output schema, the description sufficiently lists output fields and source. It could mention error handling (e.g., CVE not found) but is otherwise complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% with one parameter 'cve_id'. The description does not add meaning beyond the schema's example 'e.g. CVE-2021-44228'. Schema already describes the parameter adequately, so baseline of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb 'Look up' and resource 'CVE by ID', and lists the exact fields returned (description, CVSS score & severity, vector, CWE weakness, publish date, references). It clearly differentiates from siblings 'audit_dependencies' and 'package_vulnerabilities' which focus on different aspects of vulnerability scanning.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies using this tool when a specific CVE ID is known and a compact summary is needed. It does not explicitly state when not to use it or mention alternatives, but the context ('compact summary') and sibling names provide enough guidance for the agent.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description bears full responsibility. It reveals minimal behavior: it lists vulnerabilities via OSV and supports a version filter. Missing details like auth requirements, rate limits, or whether it is read-only.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Two concise sentences: the first states the core function with optional modifier, the second lists ecosystems. No redundancies, front-loaded, easy to scan.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no output schema and low parameter coverage (33%), the description should provide more context about return format, error behavior, or interpretation of results. It does not explain what 'vulnerabilities' entails or how results are structured.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 33% (only 'version' described). The description adds the ecosystem list and notes the optional version, partially compensating. However, 'name' and 'ecosystem' lack schema descriptions and the description does not explain their format or constraints.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action ('List known vulnerabilities'), the resource (software package), and the optional version filter via OSV. It also lists the supported ecosystems, making the tool's purpose specific and distinguishable from sibling tools like 'audit_dependencies' and 'cve_lookup'.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description does not provide guidance on when to use this tool versus its siblings ('audit_dependencies', 'cve_lookup'). It implies usage for checking package vulnerabilities but lacks explicit context or exclusions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.