Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false, so the safety profile is covered. The description adds meaningful behavioral detail beyond annotations: unmatched components are 'listed honestly rather than guessed,' and there are explicit free vs Pro tier limits (5 vs 50 matched components). These are non-obvious constraints that help the agent set expectations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Three tight sentences, each earning its place: the first defines the tool's action and scope, the second describes how unmatched components are handled, and the third covers input format and quota limits. There is no filler, repetition, or unnecessary qualification.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the annotations cover safety and an output schema exists, the description provides everything needed to invoke the tool correctly: accepted SBOM formats, input representation, matching/scoring behavior, and quota limits. There are no obvious gaps for a read-only, idempotent SBOM audit operation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema already documents both parameters well (SBOM format and max_items default 50), so the baseline is 3. The description adds value by clarifying tier-dependent behavior: free tier caps at 5 matched components while Pro allows 50, which directly affects how max_items should be interpreted. This is exactly the kind of operational nuance the schema doesn't convey.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb ('Audit') and a concrete resource ('CycloneDX or SPDX JSON software bill of materials'), then immediately states the core value (mapping components to tracked products and scoring EOL risk). This clearly distinguishes it from sibling tools like check_eol or get_product_lifecycle, which focus on individual products rather than a full SBOM document.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description makes the intended use obvious: pass an SBOM document to get EOL risk scoring for its components, with unmatched ones explicitly reported. It also tells the user how to supply the SBOM (as a JSON string or object). However, it doesn't name sibling alternatives or explicitly state when not to use this tool, but the context is clear enough.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.