nist-nvd-mcp-server

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With readOnlyHint=true and idempotentHint=true already in annotations, the description adds meaningful context by revealing that with cpeName, results are scoped to configurations where the product is 'directly vulnerable, not merely referenced as a dependency.' It also states that it returns full CVE records, which sets expectations beyond what annotations convey, though it does not address rate limits or other side effects — not required given the annotation coverage.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Four sentences, each earning its place: purpose, required input modes, scoping nuance, and the prerequisite tool. The most important information is front-loaded, and there is no filler or redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool is complex (10 parameters, 0 required), but the schema and output schema cover input mechanics and return structure well. The description provides the essential context an agent needs to choose this tool, including the prerequisite nvd_search_cpes and the behavioral nuance around cpeName. It does not explicitly mention pagination or severity filtering, but those are already described in the schema, so the description is sufficiently complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the baseline is 3. The description enriches the cpeName vs virtualMatchString distinction by explaining the scoping difference between an exact CPE match and a partial match with version bounds, and it reinforces the mutual exclusivity condition. This adds semantic nuance beyond the schema's field descriptions, justifying a 4.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'Find all CVEs affecting a specific product and version using CPE,' which immediately states the tool's function. It further distinguishes itself from generic CVE search by explaining the scope difference when using cpeName vs virtualMatchString, and it names nvd_search_cpes as a prerequisite, clearly delimiting its role relative to siblings.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly directs the agent to 'Use nvd_search_cpes first to resolve the correct CPE string for a product,' providing a clear when-to-use instruction, and it states the required input modes (cpeName or virtualMatchString with optional version bounds). However, it does not explicitly contrast with nvd_search_cves or other siblings, so it stops short of the explicit 'when-not-to-use' guidance needed for a 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint and idempotentHint, so the safety profile is covered. The description adds meaningful behavioral context beyond that: the response shape (CVSS versions, CWE, CPE, KEV, references), the 100-ID cap, and a concrete size warning about 1MB+ responses. This goes beyond the minimum expected.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Three tightly written sentences with no filler. The core action and scope come first, followed by return-value summary, then the capacity warning and parameter recommendation. Every sentence earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a read-only lookup tool with a rich output schema and full parameter documentation, the description is complete. It covers the main operational caveat (response size for large batches), the ID limit, and the available fields. Nothing needed to call it correctly is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3. The description adds practical semantics for the brief parameter by recommending it for batches over 10 IDs and explaining the context-budget rationale. This provides value above the schema's default-value description, justifying a 4.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'Fetch one or more CVEs by ID from the NIST National Vulnerability Database.' It enumerates the returned data (CVSS versions, CWE, CPE, KEV, references), making the tool's role unmistakable and clearly distinct from the search-oriented sibling tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description states this tool is for fetching by CVE ID, which implies it should be used when IDs are already known, distinguishing it from nvd_search_cves. It also gives explicit guidance for bulk usage: 'For bulk lookups of more than 10 IDs, use brief: true.' It lacks an explicit 'when not to use' or named alternatives, but the context is clear.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and idempotentHint=true, so the safety profile is covered. The description adds meaningful behavioral context: newest-first default ordering, the ability to request oldest order, and a performance warning about the endpoint being slower without an API key. None of this contradicts the annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Four sentences with no filler. The purpose is front-loaded, and each subsequent sentence adds distinct value: use cases, ordering behavior, alternative tool, and performance/API guidance. Every sentence earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the presence of a full output schema and a comprehensive input schema, the description covers the essential operational context: what the tool returns (change history types), when to use it, how to control ordering, and a critical performance caveat. Nothing an agent needs to call it correctly is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, and the schema itself already provides rich descriptions for every parameter, including the order enum's cost implications and the offset anchoring. The description repeats the newest-first default but adds little beyond the schema. Since the schema carries the semantic load, a baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb-resource pair ('Retrieve the change history for a single CVE') and enumerates the concrete change types (CVSS revisions, reference additions, status transitions, CPE updates). It also distinguishes itself from the sibling nvd_get_cve by explicitly directing agents to that tool for the current record, so there is no ambiguity.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives explicit use cases ('tracking a CVE's escalation or investigating when a score changed') and an explicit exclusion ('For the current record, call nvd_get_cve instead'). It also adds operational guidance (set NVD_API_KEY due to endpoint slowness), which informs when to use it versus alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and openWorldHint=false, covering the safety profile. The description adds meaningful behavioral context: it returns deprecation status and emphasizes the precision of CPE strings, which is not apparent from annotations or schema. It does not contradict the annotations, and adds value beyond them.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences with no wasted words. The core purpose and return values are front-loaded, and the usage guidance is placed right after. It is concise, structured, and every sentence earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a read-only search tool with annotations covering safety and an output schema, the description is complete. It covers what the tool does, what it returns, and when to use it. The only potential gap (pagination behavior) is already documented in the schema via the offset description. An agent has everything needed to call it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so all parameters (limit, offset, keyword, cpeMatchString) are already documented in the schema. The description reiterates the two main search modes (keyword or partial match) but does not add new meaning beyond the schema. Baseline 3 is appropriate since the schema handles parameter documentation.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: searching the NVD CPE dictionary by keyword or partial match, and lists the return types (CPE names, titles, deprecation status). It explicitly differentiates itself from the sibling nvd_audit_cpe by explaining it is a prerequisite for that tool, so an agent can immediately tell when to use it.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives explicit guidance: 'Use before nvd_audit_cpe to resolve the correct CPE name'. It also explains why exact matching matters, which helps the agent understand the workflow. While it doesn't list exclusions for every sibling, the primary alternative is named and the usage context is clear.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already mark the tool read-only, and the description adds non-obvious behaviors: pubDays/lastModDays expand to date pairs with values over 120 days clamped and reported in response enrichment, and an unfiltered query returns NVD default index order (oldest first). It also discloses that results are brief summaries. No contradiction with readOnlyHint.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Five sentences, each carrying distinct information: scope, role, shorthand behavior, routing to nvd_get_cve, and the unfiltered default order. The content is front-loaded with the main action and doesn't repeat schema or annotation details. No filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 15-parameter tool with a rich schema and output schema, the description covers the high-level purpose, the key parameter behavior (clamping/date-pair expansion), the routing rule, and the unfiltered default. It could add operational details like rate limits and ordering for filtered queries, but the essential call-time behavior is present.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% with detailed descriptions, defaults, enums, and mutual exclusions for all 15 parameters. The description adds a small amount beyond the schema: pubDays/lastModDays are 'convenience shorthands that expand to date pairs' and clamped values are 'reported in the response enrichment,' which tells the agent where to observe the clamp. This modest addition justifies a slight bump above the high-coverage baseline.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and object ('Search CVEs') and enumerates the filter dimensions (keyword, severity, CWE, date range, KEV status). It positions the tool as the 'primary discovery tool' and explicitly routes full-detail lookups to nvd_get_cve, distinguishing it from that sibling. The resource focus on CVEs also separates it from nvd_search_cpes.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

It states a clear usage context: 'primary discovery tool for vulnerability surveillance and triage workflows.' It also gives an explicit when-not and alternative: since it 'returns brief summaries,' the agent is told to 'call nvd_get_cve for full detail on specific IDs.' The recommendation to use at least one filter and the warning about default index order provide operational guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.