Compute the readiness-score and HNDL change between two finding sets (e.g. before and after a migration). Pass 'before' and 'after' as arrays of findings from scan_path --format json.
| Name | Required | Description | Default |
|---|---|---|---|
| after | Yes | Findings after the change. | |
| before | Yes | Findings before the change (from a scan's JSON findings). |
Changes observed during successful MCP inspections.
Input schema / properties / after / itemsAdded value: +{
+ "description": "A single finding from `scan_path --format json`.",
+ "properties": {
+ "algorithm": {
+ "description": "Classical algorithm family, when applicable.",
+ "type": "string"
+ },
+ "category": {
+ "type": "string"
+ },
+ "confidence": {
+ "type": "string"
+ },
+ "cwe": {
+ "description": "e.g. \"CWE-327\".",
+ "type": "string"
+ },
+ "hndl": {
+ "description": "Exposed to harvest-now-decrypt-later.",
+ "type": "boolean"
+ },
+ "location": {
+ "description": "Where the finding is.",
+ "properties": {
+ "file": {
+ "type": "string"
+ },
+ "line": {
+ "type": "number"
+ }
+ },
+ "required": [
+ "file"
+ ],
+ "type": "object"
+ },
+ "message": {
+ "type": "string"
+ },
+ "remediation": {
+ "type": "string"
+ },
+ "ruleId": {
+ "description": "Stable rule id, e.g. \"rsa-keygen\".",
+ "type": "string"
+ },
+ "severity": {
+ "description": "critical | high | medium | low | info.",
+ "type": "string"
+ },
+ "title": {
+ "type": "string"
+ }
+ },
+ "required": [
+ "ruleId",
+ "location"
+ ],
+ "type": "object"
+}Input schema / properties / before / itemsAdded value: +{
+ "description": "A single finding from `scan_path --format json`.",
+ "properties": {
+ "algorithm": {
+ "description": "Classical algorithm family, when applicable.",
+ "type": "string"
+ },
+ "category": {
+ "type": "string"
+ },
+ "confidence": {
+ "type": "string"
+ },
+ "cwe": {
+ "description": "e.g. \"CWE-327\".",
+ "type": "string"
+ },
+ "hndl": {
+ "description": "Exposed to harvest-now-decrypt-later.",
+ "type": "boolean"
+ },
+ "location": {
+ "description": "Where the finding is.",
+ "properties": {
+ "file": {
+ "type": "string"
+ },
+ "line": {
+ "type": "number"
+ }
+ },
+ "required": [
+ "file"
+ ],
+ "type": "object"
+ },
+ "message": {
+ "type": "string"
+ },
+ "remediation": {
+ "type": "string"
+ },
+ "ruleId": {
+ "description": "Stable rule id, e.g. \"rsa-keygen\".",
+ "type": "string"
+ },
+ "severity": {
+ "description": "critical | high | medium | low | info.",
+ "type": "string"
+ },
+ "title": {
+ "type": "string"
+ }
+ },
+ "required": [
+ "ruleId",
+ "location"
+ ],
+ "type": "object"
+}Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. The verb 'Compute' implies a read-only operation, but it doesn't explicitly state side effects, permissions, or what happens with malformed input. It adds input source guidance but doesn't elaborate on the computation logic or output behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a two-sentence, front-loaded statement that efficiently states the purpose and input requirements. Every word earns its place, with no redundancy or fluff.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
There is no output schema, so the description should explain what the tool returns (e.g., the shape of the delta or readiness-score change). It doesn't mention output format or clarify the meaning of 'readiness-score' and 'HNDL change'. The example helps but leaves significant ambiguity for a computation tool without output documentation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the schema already documents both parameters in detail. The description adds value by telling the agent to pass arrays from 'scan_path --format json', which clarifies the expected input source beyond the schema. This extra guidance justifies a 4.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool computes 'readiness-score and HNDL change' between two finding sets, using a specific verb ('Compute') and resource. The example ('before and after a migration') and focus on delta distinguish it from sibling tools like triage or remediation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It provides clear context for when to use the tool (comparing two finding sets, e.g., migration) and specifies input format ('Pass before and after as arrays of findings from scan_path --format json'). However, it doesn't explicitly state exclusions or alternative tools, so it falls short of a 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Add one secure layer between your agents and this server.