Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description discloses substantial behavior beyond the annotations: CISA KEV acts as an automatic top-priority override, EPSS is the primary ranking signal, severity is fallback, and the result is a composite score with tiers. It also exposes deduplication behavior for shared CVE IDs, which is valuable operational context not present in the annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with the core purpose and then builds outward into signals, exclusions, and deduplication behavior. Each sentence adds meaningful guidance, and the length is justified by the complexity of the ranking logic and the need to differentiate from sibling tools.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with one parameter, full schema coverage, and an output schema, the description is complete: it explains input provenance, ranking inputs, what enrichment is added, what is not done, and the output tier concept. No critical invocation detail is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents the fields including cveId's enrichment role and severity's fallback role. The description adds some clarifying context about passing through existing findings and deduplicating shared CVE IDs, but this is largely behavioral rather than genuinely new parameter-level semantics.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource: it takes a batch of already-flagged vulnerability findings and ranks them by fix priority. It also distinguishes itself from siblings by explicitly saying it does NOT re-query OSV/NVD and that findings come from tools like batch_query_vulnerabilities or query_vulnerabilities.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly says when to use it (after other tools have flagged findings) and what it does not do (no OSV/NVD re-query), naming concrete alternatives. It also clarifies the data flow: pass in severity/CVE findings and receive KEV/EPSS enrichment plus ranking.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.