Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

There are no annotations, so the description carries the full behavioral burden, but it only defines EPSS conceptually. It does not disclose what input is accepted, what value range is returned, whether the lookup is by CVE ID, or any limitations or side effects.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is short and front-loaded, but brevity here is under-specification rather than efficient concision. It contains only a definitional gloss, not the information an agent needs.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The output schema may cover return values, but the tool description still omits the required context for constructing a call: what q is, what the expected input format is, and how this differs from similar CVE/exploit tools. This is not adequate for correct invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema documents a single optional 'q' string with zero description coverage, and the tool description does nothing to explain what q should contain. Despite the low complexity, the missing parameter meaning makes the tool effectively uninvocable with confidence.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description is mostly a noun-phrase label: 'EPSS Score' restates the tool title, and 'Exploitation probability (FIRST EPSS)' expands the acronym rather than stating an operation. It does not say what operation the tool performs, what resource it acts on, or how it differs from siblings like cve, cve_severity, or exploit_cve.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no guidance about when to use this tool versus the many closely related CVE/exploit siblings. No alternatives, exclusions, prerequisites, or typical use cases are mentioned, so an agent cannot infer selection criteria.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.