Deterministically attach your triage verdicts to their findings and re-sort by exposure (highest first). Never suppresses. Pass the same 'findings' array you triaged plus a 'verdicts' array of { fingerprint, exposureScore, priority, rationale }.
| Name | Required | Description | Default |
|---|---|---|---|
| findings | Yes | The findings that were triaged. | |
| verdicts | Yes | One verdict per finding, keyed by fingerprint. |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the burden of behavioral disclosure. It adds meaningful traits: 'Deterministically' (guarantees reproducible output), 'Never suppresses' (assures no findings are hidden), and 're-sort by exposure' (defines ordering). While it doesn't describe return shape or error handling, the key behavior is clearly disclosed beyond a generic 'attach'.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences, front-loaded with the primary action and key behavioral guarantees. No redundant information; every clause earns its place. The structure is efficient and scannable.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool has two complex array parameters and no output schema, but the description provides essential context: the input arrays and their relationship, the deterministic merge, and sorting behavior. It implicitly covers the return value (attached, sorted findings). It could mention what happens on mismatched fingerprints or if verdicts are missing, but overall it is adequate for use.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so baseline is 3. The description adds value by clarifying the relationship between parameters: 'Pass the same `findings` array you triaged plus a `verdicts` array...' and explicitly lists the required verdict fields. This reinforces the schema and gives practical usage meaning beyond type definitions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's function: 'Deterministically attach your triage verdicts to their findings and re-sort by exposure (highest first).' This uses a specific verb (attach) and resource (findings + verdicts), and distinguishes itself from siblings like triage_findings (which likely produces verdicts) and remediate_findings (which likely takes actions). The additional behavior 'Never suppresses' further clarifies purpose.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives a clear usage context: 'Pass the same `findings` array you triaged plus a `verdicts` array...' This implies this tool is used after a triage step, effectively differentiating it from siblings. However, it does not explicitly state when NOT to use it or name alternatives, so it misses the full 'when/when-not' guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Add one secure layer between your agents and this server.
Most tools target distinct parts of the PQC remediation workflow (explain, triage, fix, verify), but verify_fix and apply_verified_patch have overlapping purposes: both check code for remaining classical crypto. The latter adds patch-policy and blast-radius gates, making the boundary somewhat blurry.
All tool names follow a consistent verb_noun snake_case pattern (e.g., list_rules, triage_findings, verify_fix). There are no mixed conventions or unpredictable naming variations.
11 tools is well within the ideal range for a specialized toolkit. Each tool addresses a distinct step in the migration process: understanding, triaging, remediating, verifying, and scoring.
The set covers the core lifecycle: rule discovery, finding explanation, triage, remediation bundling, patch verification, and progress measurement. The only notable gap is that it relies on an external scan_path to provide findings—no scan tool is included—but this appears to be an intentional separation of concerns.