Produce a deterministic triage REQUEST bundle (rubric + verdict schema + per-finding metadata) for YOU (the host agent) to reason over. This tool does NOT call any model and needs no API key. Assess each finding's real-world exposure, then call apply_triage with your verdicts. Pass 'findings' as an array from scan_path --format json.
| Name | Required | Description | Default |
|---|---|---|---|
| findings | Yes | Findings from a scan's JSON output. |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden. It clearly states the tool does NOT call any model, needs no API key, and is deterministic — traits not inferable from the schema or annotations otherwise. It does not mention potential side effects, but as a request-bundle producer, side effects are unlikely.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise: four sentences, each with a distinct purpose — defining the output, clarifying behavioral traits, giving the next step, and specifying the parameter source. No wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description provides sufficient context for a one-parameter tool with no output schema. It explains the tool's role in the overall triage workflow, the nature of its output, and the follow-up action. This is complete enough for the host agent to invoke it correctly and know what to do next.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema already covers the 'findings' parameter thoroughly, so baseline is 3. The description adds value by directing the host agent to pass findings from scan_path --format json, which clarifies the expected data source and format beyond the schema's generic 'from a scan's JSON output'.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: produce a deterministic triage REQUEST bundle. It specifies the exact output (rubric + verdict schema + per-finding metadata) and distinguishes itself from sibling apply_triage by framing itself as the preparation step.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives a clear workflow: assess findings, then call apply_triage with your verdicts. It also tells users how to supply the 'findings' parameter (from scan_path --format json). While it doesn't explicitly list when not to use it, the context and mention of apply_triage make the intended usage unambiguous.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Add one secure layer between your agents and this server.
Most tools target distinct parts of the PQC remediation workflow (explain, triage, fix, verify), but verify_fix and apply_verified_patch have overlapping purposes: both check code for remaining classical crypto. The latter adds patch-policy and blast-radius gates, making the boundary somewhat blurry.
All tool names follow a consistent verb_noun snake_case pattern (e.g., list_rules, triage_findings, verify_fix). There are no mixed conventions or unpredictable naming variations.
11 tools is well within the ideal range for a specialized toolkit. Each tool addresses a distinct step in the migration process: understanding, triaging, remediating, verifying, and scoring.
The set covers the core lifecycle: rule discovery, finding explanation, triage, remediation bundling, patch verification, and progress measurement. The only notable gap is that it relies on an external scan_path to provide findings—no scan tool is included—but this appears to be an intentional separation of concerns.