Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already show read-only and non-destructive, but the description adds valuable behavioral details: it fans out across two services, returns a specific summary block, and handles partial failures gracefully. It even notes the 5-30s delay for first bundlephobia measurement and that sources_failed will indicate timeouts.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is detailed but every sentence adds value: purpose, usage, output, ecosystem scope, and failure handling are all covered without fluff. The structure is logical and front-loaded with the main purpose.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (composite of two services) and no output schema, the description fully compensates by enumerating the summary fields, per-advisory details, links, and alternative versions. It also covers edge cases (partial failures, timeouts) and ecosystem limitations.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3. The description adds extra context beyond the schema: explains the composite fan-out behavior, mentions NPM-only scope, and lists the exact output fields, which helps infer parameter impact. It also adds an example ('lodash') that clarifies usage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it is a composite check for deciding whether to add an npm package, combining deps.dev and bundlephobia data. It specifies the exact use case and distinguishes from sibling tools like scan_competitor_ai_presence by focusing on dependency analysis.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly says when to use: whenever the agent asks about safety, popularity, or size of an npm package. It also gives an exclusion: NPM only in v1, with a fallback to deps.dev:version for other ecosystems. This provides clear guidance vs alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.