Exploit Intelligence Platform — CVE, Vulnerability and Exploit Database

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the annotations (readOnly, openWorld, idempotent, non-destructive), the description discloses the rate-limit cost (up to 2 API calls per technology, 10 for 5) and the sorting/grouping behavior. This adds valuable operational context not captured by annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is three sentences, front-loaded with the purpose, then usage and cost details. No redundant filler; each sentence adds value.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers purpose, usage, input format, output format (risk-sorted list grouped by technology), and rate-limit implications. For a one-parameter tool with no output schema, this is fully complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema already fully describes the single parameter with its format, max length, and max 5 constraint. The description repeats this information and adds an example, but does not provide additional semantic details beyond the schema. Baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

Clearly states the tool audits a technology stack for exploitable vulnerabilities, specifying it searches for critical/high severity CVEs with public exploits and sorts by EPSS. This distinguishes it from sibling search tools like search_exploits and search_vulnerabilities.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly says 'Use this when a user describes their infrastructure and wants to know what to patch first,' providing clear usage context. It doesn't explicitly exclude alternatives, but this is sufficient guidance for when to invoke.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare read-only, idempotent, and non-destructive behavior. The description adds transparency by disclosing the return value: database status and timestamps for each of the 10 ingestion sources. This goes beyond the annotations by specifying what data is returned.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, front-loaded sentence that immediately states the purpose and then provides key details. There is no unnecessary information, making it highly concise and well-structured.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Despite having no output schema, the description adequately explains what the tool returns (database status and timestamps per ingestion source). The annotations cover safety aspects, and the tool's simplicity means no additional context is needed. It is complete for its purpose.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters, and the schema fully covers all parameters (100% coverage). The description does not need to add parameter details. Baseline for 0 parameters is 4, which is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states a specific verb ('Check') and resource ('EIP API health and data freshness'). It distinguishes itself from sibling tools by focusing exclusively on health status and timestamps across ingestion sources, which is unique among the listed siblings.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides clear context for when this tool is relevant (to check API health and data freshness), though it does not explicitly mention alternatives or exclusions. Given the tool's self-evident purpose, this is acceptable but not exhaustive.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare read-only, idempotent, non-destructive behavior. The description goes beyond by disclosing that it fetches full vulnerability details, formats them into Markdown with specific fields (severity, CVSS, description, etc.), and produces ready-to-paste output. This adds practical behavioral context without contradicting annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is four sentences long and includes a concrete example. Every sentence contributes meaning: what it does, what it accepts, what output to expect, and a practical illustration. No redundancy or filler, making it easy to parse quickly.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's simplicity (3 params, no nested objects, no output schema), the description provides sufficient context for correct invocation. It explains the input identifiers, optional parameters, output format, and the content of the finding. An agent can understand what will happen and what to expect without additional documentation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema already describes all three parameters with 100% coverage. The description adds value with a concrete example showing how to use 'cve_id', 'target', and 'notes' together, and explains their role in the generated finding (optional target and tester notes). This goes slightly beyond the schema's basic descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: generating a pentest report finding in Markdown format for a specific vulnerability. It uses a specific verb ('Generate') and resource ('pentest report finding'), and distinguishes from sibling tools by focusing on report generation rather than search or retrieval. It also specifies that it accepts both CVE-IDs and EIP-IDs, making its scope unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides clear context for when to use the tool: when you need a formatted finding for a CVE/EIP, optionally including target and notes. It does not explicitly mention alternatives or exclusions, but the sibling tools (search/get/list) make it evident that this is not for searching or browsing data. The example further clarifies typical usage.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already indicate read-only, idempotent, and non-destructive behavior. The description adds useful behavioral context beyond annotations: it returns a 'paginated list' and notes the inclusion of 'CVE context', plus fields like activity start date. This gives agents insight into the response shape and pagination without contradicting annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences, front-loaded with the primary purpose, followed by return details and a usage example. Every sentence contributes meaning; no repetition or fluff.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a single-parameter tool with rich annotations and no output schema, the description covers the return fields, pagination, and usage context. It is sufficiently complete for an agent to invoke correctly, though it could briefly mention any error conditions or authentication needs, but those are not essential here.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema already fully describes the author_name parameter with an example. The description reinforces usage with a phrase like 'a specific researcher' and an example query, but does not add new semantic meaning beyond what the schema provides. Baseline for 100% coverage is appropriately 3.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's function: 'Get an exploit author's profile with all their exploits' and enumerates the returned fields. It distinguishes itself from siblings like list_authors (which lists authors generally) and search_exploits (which searches by criteria) by focusing on a specific researcher.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides a concrete usage scenario: 'Use this when asked about a specific researcher like "show me all exploits by Chocapikk"'. This clearly implies the tool is for targeted researcher queries, but it does not explicitly mention when not to use it or name alternative tools, so it misses the top score.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint, openWorldHint, idempotentHint, and destructiveHint, covering the safety profile. The description adds return fields but not additional behavioral traits like error handling or rate limits. It provides some context beyond annotations but is not rich in behavioral disclosure.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences long, front-loaded with the purpose, and includes a concise example. No wasted words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description lists the key return fields (full name, description, exploit likelihood, parent CWE, total vulnerability count), which is sufficient for a simple get tool. It doesn't explain error behavior but is adequate for the tool's simplicity.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema fully covers the cwe_id parameter, so baseline is 3. The description adds an example ('CWE-79') with a concrete return detail (Cross-Site Scripting), which enhances understanding beyond the schema's pattern and description.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool gets details for a specific CWE, with a specific verb ('Get'), resource ('CWE'), and scope ('specific'), distinguishing it from list_cwes. The example (CWE-79) further illustrates the purpose.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage for retrieving details of a known CWE ID but does not explicitly mention when to use this tool versus alternatives like list_cwes. No direct alternative or exclusion is stated, so the guidance is implied rather than explicit.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false. The description adds valuable behavioral context by detailing the specific return fields (classification, attack type, complexity, confidence score, deception indicators, backdoor-review verdict with operator-risk notes) and provides an example ('exploit_id=61514 returns a TROJAN warning'). This adds context beyond the structured annotations without contradicting them.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is information-dense but front-loaded with the primary purpose. It lists all significant return fields in a single sentence, adds a usage directive, and includes a concrete example. No fluff or redundancy; every sentence earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Without an output schema, the description carries the burden of explaining return value semantics. It enumerates the major categories (classification, attack type, complexity, etc.), includes conditional availability ('when available'), and provides a concrete example. This is comprehensive for a single-parameter read-only tool with strong annotations.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 100% coverage and already explains exploit_id clearly, distinguishing it from the EDB number. The description reinforces this with an example usage ('exploit_id=61514') and explains why the ID matters (to fetch the analysis), adding context beyond the schema baseline.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'Get the full AI analysis for a single exploit by its platform ID.' It clearly distinguishes from sibling get_exploit_code by focusing on AI analysis rather than code. The scope (single exploit by platform ID) is explicit.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly states when to use this tool: 'Use this to check if an exploit is safe before reviewing its code.' This gives clear context and implies a relationship with the code-fetching tool, though it does not explicitly name alternatives or provide exclusions. A 5 would require explicit when-not-to-use or named alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint, openWorldHint, idempotentHint, and destructiveHint false. The description adds valuable context beyond these: it explains that if no file_path is specified, the tool auto-selects the most relevant code file, and it clarifies the ID numbering distinction. This is useful behavioral disclosure without contradicting annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise, front-loaded with the main purpose, and every sentence serves a purpose: action, critical ID caveat, return type, and use case. No unnecessary fluff.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple read-only tool with two parameters and no output schema, the description fully covers what the tool does, how IDs work, the auto-selection behavior, and suggested use cases. An agent has enough context to select and invoke it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the baseline is 3. Both parameters are already described in the schema, including the ID distinction and file_path auto-selection. The description reinforces the ID warning but does not add meaning beyond what the schema provides.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool retrieves the source code of a specific exploit by its platform ID, using a specific verb and resource. It also distinguishes from siblings by clarifying the ID system and noting the tool returns code, unlike analysis tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides clear usage context: 'Use this to analyze exploit mechanics, understand attack techniques, or review PoC code.' It does not explicitly mention alternatives or exclusions, but the use cases are specific enough for an agent to decide when to invoke it.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, openWorldHint=true, idempotentHint=true, and destructiveHint=false. The description adds valuable context about the return content (template metadata, severity, verification status, tags, dork queries) and accepted input types. It does not describe response format or potential limitations, but given annotations, this is sufficient. No contradiction with annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is four short sentences, each with a distinct purpose: main function, return contents, accepted inputs, and use case. No redundant or extraneous information is present. It is well-structured and front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool is simple with one parameter and no output schema. The description covers its purpose, input types, output contents, and use context. It does not specify the exact response format, but the listed contents are enough for an agent to understand the output. Given the tool's simplicity, this is nearly complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%: the `cve_id` parameter has a clear description with pattern and example. The tool description reinforces the accepted ID formats but does not add significant new meaning beyond what the schema already provides. Baseline of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's function: 'Get Nuclei scanner templates and recon dorks for a vulnerability.' It specifies the resource (Nuclei templates and dorks) and lists what is returned (metadata, severity, verification status, tags, dork queries). This distinguishes it from sibling tools like get_vulnerability or search_vulnerabilities.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly states when to use the tool: 'Use this to plan scanning or reconnaissance.' It also mentions accepted ID types (CVE-ID and EIP-ID), which parameterizes usage. However, it does not explicitly exclude alternatives or describe when not to use it.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, openWorldHint=true, idempotentHint=true, and destructiveHint=false, so the safety profile is clear. The description adds specific return content (counts and timestamp) which is valuable since there is no output schema.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence that front-loads the purpose ('Get platform-wide statistics') and then lists all relevant metrics. Every word earns its place; no filler or redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple no-parameter read-only stats tool, the description fully captures the scope (platform-wide) and the expected return fields. Combined with rich annotations and no output schema, it provides enough context for an agent to invoke correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

This tool has zero parameters, so the schema coverage is 100% by default. Baseline 4 applies, and the description does not need to add parameter information.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses the specific verb 'Get' with resource 'platform statistics' and enumerates the exact counts returned (vulnerabilities, exploits, KEV entries, etc.), clearly distinguishing it from sibling tools that focus on individual entities. The purpose is unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description establishes clear context: it returns platform-wide aggregate statistics. However, it does not explicitly state when to use this over siblings or provide exclusion criteria, though the scope implies its use when summary counts are needed.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description goes beyond annotations by detailing the exact contents of the return: CVSS, EPSS, KEV status, affected products, and ranked exploits. It also explains the exploit ranking order and that trojans are flagged at the bottom, which is non-obvious behavioral info. Annotations already mark it read-only, so this extra detail is valuable.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is structured with a purpose statement, input format, return content list, and ranking policy. Each sentence earns its place, providing dense but necessary information without redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (no output schema), the description lists the major return categories and explains the exploit ranking. It also covers the accepted input formats. This is complete enough for an agent to invoke it correctly and know what to expect.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema already fully documents cve_id with examples and pattern. The description adds the meaning of EIP-IDs as 'pre-CVE entries,' which enriches the parameter semantics beyond the schema. Since schema coverage is 100%, the baseline is 3, but this addition justifies a 4.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description specifies 'Get a full intelligence brief for a specific vulnerability' with a clear verb and resource, distinguishing it from related search tools like search_vulnerabilities. It also mentions both CVE and EIP IDs, making the target explicit.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

It clearly implies this tool is for when a specific CVE/EIP ID is already known, as it states 'Accepts both CVE-IDs and EIP-IDs.' However, it does not explicitly name alternatives or when not to use it, so it earns a 4 rather than a 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already convey read-only, idempotent, open-world, non-destructive behavior. The description adds meaningful context about the ranking order (by exploit count) and the specific output (counts and handles), which is beyond the structured annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, front-loaded with the core purpose and then the helpful usage examples. No redundant wording; every sentence earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple list tool with no output schema, the description conveys the main output (exploit counts and handles) and ranking behavior. It could mention that for specific author details one would use get_author, but overall it is adequately complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema covers both parameters (page and per_page) with descriptions, defaults, and constraints, so coverage is 100%. The description does not add parameter-specific meaning beyond the schema, hence baseline 3.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool lists exploit authors/researchers ranked by exploit count, returning top security researchers with exploit counts and handles. It uses a specific verb and resource, and distinguishes from sibling get_author by focusing on ranked lists.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly gives usage triggers: 'when asked who are the top exploit authors?' or 'who writes the most exploits?' This provides clear context for when to use the tool, though it does not mention exclusions or alternatives like get_author.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint, openWorldHint, idempotentHint, and destructiveHint, so the safety profile is clear. The description adds useful behavioral context beyond annotations by specifying that results are ranked by vulnerability count and listing exact return fields, which is valuable for the agent.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences, front-loaded with the core purpose, then followed by a concrete usage example. Every sentence earns its place with no unnecessary words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple no-parameter tool with strong annotations, the description fully covers what the tool returns and when to use it. The absence of an output schema is compensated by the explicit enumeration of returned fields, making the description complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

This tool has zero parameters, so the baseline is 4 per the rubric. The description doesn't need to explain parameters because there are none, and it doesn't add any parameter-related confusion.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('list') and resource ('CWE categories') and clearly states the ranking ('ranked by vulnerability count'). It also enumerates the returned fields, distinguishing it from sibling tools like get_cwe.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly says 'Use this when asked what are the most common vulnerability types?' providing a clear trigger. It doesn't explicitly mention alternatives or when not to use it, but the context is clear even without exclusions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the read-only and idempotent annotations, the description reveals the database's CPE naming convention and provides an example, which is helpful behavioral context not covered by annotations or schema.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is three sentences, front-loaded with the core action, and every sentence adds value: purpose, usage, and a concrete example. No waste.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple single-parameter read-only tool with no output schema, this description is sufficiently complete. It covers purpose, usage, and naming conventions, which is all the context needed.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema already fully documents the vendor parameter (100% coverage), so the description adds little extra semantic meaning for the parameter itself. The example output is helpful but does not significantly enhance parameter understanding.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool lists products for a specific vendor with vulnerability counts, which is a specific verb+resource action. It distinguishes itself from sibling tools like list_vendors by focusing on products, and adds valuable context about CPE naming conventions.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

It explicitly says 'Use this to discover exact product names for filtering,' providing clear usage context. It does not explicitly mention alternatives or exclusions, but the intended use case is evident given the sibling tools.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already indicate read-only, non-destructive, and idempotent behavior. The description adds useful behavioral details: ranking by CVE count, a cap at 'top 200 vendors,' and inclusion of 'total CVE counts.' This enriches the agent's understanding without contradicting annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is three sentences, each providing distinct value: action, output specifics, and usage guidance. It is front-loaded and concise with no redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a zero-parameter, read-only listing tool with no output schema, the description sufficiently explains what the agent will receive (top 200 vendors with total CVE counts) and when to use it. No critical information is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters, so schema coverage is trivially 100%. The baseline for zero-parameter tools is 4, and the description adds no parameter semantics because none exist.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's function: 'List software vendors ranked by vulnerability count.' It specifies the resource (software vendors) and the distinguishing detail (ranked by vulnerability count), effectively differentiating it from sibling list tools like list_authors and list_products.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides explicit usage context: 'Use this when asked which vendors have the most vulnerabilities? or to understand the threat landscape by vendor.' It lacks explicit alternatives or exclusions, but the use case is clear enough to guide the agent.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The annotations already declare readOnlyHint=true, destructiveHint=false, and idempotentHint=true, covering the safety profile. The description adds behavioral context by stating the return value ('Returns the matching CVE-ID with basic severity info'), which is useful beyond what annotations provide, though it doesn't detail failure modes or edge cases.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences, front-loaded with the purpose and followed by usage guidance. Every sentence earns its place with no wasted words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With one parameter, no output schema, and clear annotations, the description provides sufficient context: it explains what the tool does, when to use it, and what it returns. The return value is specified ('CVE-ID with basic severity info'), which is essential since no output schema exists.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema description covers the alt_id parameter fully, including examples. The tool description repeats the identifiers but adds no new meaning beyond what the schema already provides. Since schema_description_coverage is 100%, the baseline is 3.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's function: 'Look up a vulnerability by an alternate identifier such as an ExploitDB ID (EDB-XXXXX) or GitHub Security Advisory ID (GHSA-XXXXX).' It specifies the resource (vulnerability) and the specific identifiers, distinguishing it from sibling tools like get_vulnerability and search_vulnerabilities.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly states when to use: 'Use this when you have an EDB number or GHSA ID and need to find the corresponding CVE.' It implies alternatives by focusing on alternate IDs, but does not explicitly mention when not to use or name an alternative tool, so it lacks full when-not/alternatives guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and destructiveHint=false, covering the safety profile. The description adds behavioral context beyond this: it emphasizes 'STRUCTURED FILTERS ONLY (no free-text query)' and clarifies that product name search is handled elsewhere, which are useful behavioral constraints. It does not describe return format, but that's less critical for a read-only search tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is informative and well-structured, with a clear opening statement, a systematic list of filter categories, a critical note about the alternative tool, and practical examples. It is lengthy but each sentence contributes necessary guidance for a tool with 16 parameters. The front-loaded main purpose makes it easy to scan.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (16 parameters, no output schema), the description covers all filter dimensions, explains key constraints, and provides usage examples. It does not explicitly describe pagination or response format, but that information is partially in the schema and the tool is a straightforward list/browse operation. The inclusion of exclusion guidance (use search_vulnerabilities for product names) makes it contextually complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3. The description adds value by grouping filters into categories and providing examples that illustrate parameter combinations, e.g., "attack_type='RCE' with reliability='reliable' for weaponizable RCE exploits" and "source='metasploit' for all Metasploit modules." These examples clarify how parameters relate and are intended to be used together, going beyond individual schema descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's function: 'Browse and filter exploits using STRUCTURED FILTERS ONLY (no free-text query).' It lists numerous specific filter dimensions (source, language, LLM classification, AI analysis) and distinguishes it from sibling search_vulnerabilities by explicitly noting that product name search should go there. This is a specific verb+resource with clear scope.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives explicit guidance on when to use this tool: 'Use this to filter by...' and provides concrete examples. It also states when NOT to use it: 'NOTE: To search by product name (e.g. 'OpenSSH', 'Apache'), use search_vulnerabilities instead — it has free-text query and get_vulnerability already includes exploits in the response.' This is an explicit alternative and exclusion.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false, so the safety profile is clear. The description adds valuable behavioral context not covered by annotations, such as the automatic sort preference for exploitation/exploit/nuclei activity when sort is omitted, and the aggregation semantics of any_exploited across three sources.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is dense but well-structured: it leads with the core function, then enumerates supported filters, notes the dynamic sort behavior, and closes with examples. Each example demonstrates a different use case and earns its place. It is not overly verbose given the tool's 21-parameter complexity.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Despite having no output schema, the description compensates by explicitly listing the returned data fields. It also covers the full filtering capability, sort options, and the dynamic default behavior. With 21 parameters, the description is remarkably complete and gives the agent enough to invoke the tool correctly without further documentation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With schema description coverage at 100%, the baseline is 3. The description adds meaning beyond the schema by clarifying that any_exploited unifies CISA KEV, VulnCheck KEV, and InTheWild.io signals, and by showing parameter combinations in context through examples. This helps the agent understand how filters interact.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description begins with a specific verb ('Search') and resource ('Exploit Intelligence Platform for vulnerabilities (CVEs)'), and explicitly lists the return fields (CVSS, EPSS, exploit counts, KEV status, etc.). This clearly distinguishes it from sibling tools like get_vulnerability and search_exploits, which have narrower or different purposes.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides clear usage context by listing supported filter types and giving four concrete examples (e.g., 'vendor="fortinet" with severity="critical" and is_kev=true sorted by epss_desc'). However, it does not explicitly state when to prefer this over single-lookup tools like get_vulnerability or list_cwes, so the when-not-to-use guidance is implied rather than explicit.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.