Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond annotations (readOnly, idempotent, etc.), the description discloses behavioral traits such as the composite fan-out across two services, partial failure degradation, a potential 5-30s delay on first bundlephobia measurement, and the sources_failed field. It also lists specific return data fields, providing transparency about what the agent will receive.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is detailed but every sentence serves a purpose: it front-loads the core value proposition, then lists use cases, return fields, ecosystem limitations, and failure behavior. It is organized in a logical flow, and the length is justified by the tool's complexity (composite operation with multiple failure modes).

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool is complex (composite, multiple data sources, partial failures) and there is no output schema, the description compensates by enumerating the exact return fields (summary block, per-advisory detail, links, alternative versions), explaining the timeout behavior, and noting how failures appear. This provides a complete picture for an agent to correctly interpret results.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema already provides full descriptions for both parameters (100% coverage), so the baseline is 3. The tool description adds minimal extra parameter meaning—it reinforces that package is an npm package and mentions version defaults to latest, but these details are already in the schema. It doesn't significantly enrich parameter semantics beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool is a composite check for 'should I add this npm package to my project', naming specific data sources (deps.dev, bundlephobia) and the types of questions it answers (safe/popular/small, cost of adding lodash). It distinguishes itself from siblings by focusing solely on npm dependency evaluation, unlike the other tools which target AI, research, entities, or comparisons.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly says 'Use whenever an agent asks is X safe / popular / small' and provides a concrete example. It also states an exclusion: 'NPM ecosystem only in v1; PyPI / Maven / Cargo / Go fall under deps.dev:version directly', directing users to an alternative for non-npm packages. This is clear when-to-use and when-not-to-use guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.