get_public_cve_recordReturn one cleared Hacker Bob CVE record by identifier, including its open-source project, publication status, and upstream public record URL when available.
| Name | Required | Description | Default |
|---|---|---|---|
| recordId | Yes | CVE identifier such as CVE-2026-47747. |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The annotations already disclose readOnly, idempotent, and non-destructive behavior. The description adds useful context about what fields appear in a successful result and explicitly caveats that the upstream URL is included 'when available'. It does not describe behavior for unknown identifiers or auth, but annotations carry the safety burden well.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single informative sentence that leads with the core action and outcome, then lists the key return fields. No words are wasted, and the essential 'by identifier' scoping is up front.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple single-record read-only getter, the description is quite complete: it names the identified, the returned context, and one conditional absence. Missing behavior around invalid or not-found identifiers is a minor gap, especially with no output schema present.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema covers the sole parameter recordId completely with a pattern and an example. The description reinforces that the record is retrieved by identifier but does not add any semantic detail beyond what the schema already provides. With full schema coverage, the baseline score of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's specific action—'Return one cleared Hacker Bob CVE record by identifier'—and describes what is included. The singular 'one' and reference to a specific record immediately distinguishes this from the plural list and search tools among its siblings.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description clearly implies this tool is for fetching a single record when an identifier is available, but it does not explicitly say when to use the list or search siblings instead. There is no exclusionary guidance such as 'when you don't have a CVE ID, use search instead'.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Add one secure layer between your agents and this server.
The get tool is clearly distinct because it returns a single record by identifier, but list_public_cve_records and search_public_cve_records overlap significantly: both support filtering by project and publication status, and search also supports CVE identifiers. An agent could easily be unsure whether to use list with filters or search for a given query.
All tool names follow a consistent get_X, list_X, search_X pattern, using the same resource noun and snake_case throughout. Singular for get and plural for list/search is also a predictable and conventional distinction.
Three tools is a well-scoped size for a read-only public records lookup service. Each tool covers a distinct high-level operation: fetch one, browse a list, and search the corpus.
For a read-only public CVE records server, the surface is complete: agents can retrieve a specific record, browse all records with pagination, and search across the available fields. There are no obvious dead ends or missing lifecycle operations since this domain does not call for create/update/delete.