Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations only declare readOnly and openWorld; the description goes far beyond by disclosing 'one tool call, no auth', the size and curation of the deny-list (230k+ entries), thin RubyGems coverage, zero Packagist deny-list entries, version-aware matching semantics, and the rule that CVEs yield verdict:'review' rather than block. It also documents the exact 'malicious:true' versus 'malicious:false' meaning, which is the key behavioral distinction an agent needs.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with purpose, then return shape, then semantics, then examples — a sensible order with almost no filler. It is somewhat long and the examples restate the verdict logic already given in prose, but each sentence carries substantive information rather than padding.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description still enumerates the returned fields ({ecosystem, package, version, malicious, verdict, reason, advice, source}) and explains the verdict values, so an agent knows exactly what it will receive. Combined with the coverage caveats and auth disclosure, nothing needed to call or interpret the tool is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3. The description nonetheless adds real meaning beyond the schema: the github-actions name format (owner/repo@v45.0.7 or name + version) and the advice to pin a full commit SHA for the strongest check, plus the note that version-scoped entries make the check version-aware while all-versions-malicious packages block on any version.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

Opens with a specific verb and resource: checks whether a dependency in named ecosystems is on a malicious-package deny-list or has advisories. Scope (four ecosystems plus GitHub Actions) is stated up front, so an agent can tell instantly this is a supply-chain lookup, not a generic search or enrichment call like its siblings.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly situates the tool as a pre-install step in an agent or CI pipeline and names the threat model (slopsquatting, hijacked packages). It also gives decision guidance on interpreting outcomes — 'absence is NOT proof of safety, so still pin and review new deps' — and notes the coverage caveats for RubyGems and Packagist that determine when the tool is less authoritative.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.