Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the readOnly/openWorld/non-destructive annotations, the description adds substantial behavioral detail: it defines license classification categories, explains how SPDX OR/AND/WITH expressions are evaluated, states that mixed nested expressions are reported as needsReview, and notes that policy.deny always overrides policy.allow. It also exposes the limitation that LICENSE file contents are not parsed. These disclosures meaningfully shape agent expectations and contradict nothing in the annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The first sentence is a compact, front-loaded summary of the tool's core purpose, and each subsequent sentence adds a distinct non-obvious behavior: classification categories, SPDX expression interpretation, mixed-expression fallback, deny precedence, and the registry-field limitation. The length is proportionate to the tool's complexity, with no filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a two-parameter tool with nested schemas and an output schema, the description covers the input format, optional policy behavior, expression evaluation rules, precedence semantics, and a critical limitation. An agent has enough information to decide whether to invoke the tool and what kinds of results to expect, and the output schema handles return-value details.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema already documents both parameters and their fields at 100% coverage, providing a strong baseline. The description goes further by giving concrete semantics: packages can come 'straight from a package.json dependencies object', version accepts exact or semver ranges, omitted version means latest, deny always wins over allow, and omitted policy means the default policy applies. This adds practical invocation guidance beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific action: resolving a list of packages' declared SPDX licenses and reporting a compliance verdict per package, with the title naming the resource and goal. The focus on licensing, policy handling, and per-package verdicts clearly distinguishes it from sibling vulnerability, provenance, and maintainer-focused tools without needing explicit cross-references.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description clearly states when to use the tool: given a list of packages and an optional allow/deny license policy. It also clarifies that omitting the policy uses the default, and it emphasizes the limitation that only the registry-declared license field is read. It does not explicitly name alternative sibling tools or state 'when not to use', so it falls just short of a 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.