KernelScan

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden and excels. It discloses that creation triggers an analysis consuming shared quota, that uploads are single-use and expire, that factor_ids are silently ignored without plan permission, and distinguishes durable monthly quota from transient rate limits. This is comprehensive.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is structured with a summary, numbered workflow steps, a code example, and warnings. It is long but every sentence earns its place given the tool's complexity. Front-loaded with the core purpose and then details.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a complex tool with prerequisites, plan gates, quotas, and error modes, the description covers all necessary context. It also notes the return value ('initial stats'), which is helpful given no output schema. Overall, it is complete enough for an agent to use correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%, so the description must compensate. It provides deep detail on config_upload_id (how to obtain, expiry, workflow) and factor_ids (plan-gated behavior). Other parameters like name, kernel_version, arch are self-explanatory, but the critical one is fully covered.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states 'Create a new product, run analysis, and return its initial stats.' This is a specific verb+resource+output combination. It distinguishes itself from sibling tools like update_product, get_product, and list_products by focusing on creation and analysis.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides an explicit workflow: upload a config first via curl, then pass the resulting config_upload_id. It explains plan restrictions, quota limits, and error handling (409 for duplicate names, 429 for monthly limit). It even advises checking whoami before batch creates, which is actionable guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden and excels. It details behavior based on caller type, access levels, error responses, and inclusion of AI fields, going beyond a basic fetch description.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with a clear first sentence but includes a lengthy second paragraph with conditional details. Fairly well-structured but could be more concise.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's simplicity (one parameter, no output schema), the description is comprehensive: it explains the exact behavior, access tiers, and edge cases, leaving no major gaps.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 0% description coverage, and the description adds an example ID format but does not fully specify the parameter constraints or allowed values. It partially compensates but leaves room for ambiguity.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool fetches a single Linux kernel CVE by ID, specifying the verb and resource. However, it does not explicitly distinguish this from the sibling search_cves tool, leaving some ambiguity.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides clear context on usage for different caller types (keyless, free keyed, pro/enterprise), including when results are returned vs not found or 404. It does not explicitly mention when to use this tool over alternatives, but the sibling context implies it.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided, so description carries full burden. It discloses the 404 behavior for other owners, which is a key security detail, but omits other aspects like error handling or rate limits.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, to the point, no fluff. Front-loaded with the core purpose.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple fetch tool with one parameter and no output schema, the description covers purpose and security behavior, but lacks parameter details and return format, making it adequate but not complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0% and the description does not explain the product_id parameter beyond implication. Adding format or constraints would improve usability.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool fetches one product including CVE breakdown, distinguishing it from list_products (list) and get_cve (CVE only).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides a security note about 404 vs 403 to prevent info leakage, which is helpful for correct usage, but lacks explicit when-to-use vs siblings.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Discloses caching (24h cache) and regeneration via get_product, which is valuable behavioral context, but does not cover error handling or permissions. No annotations exist, so description carries full burden.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Two concise sentences are front-loaded, with zero waste. Every sentence adds value.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple retrieval tool with a standard format (CycloneDX VEX), the description covers caching and regeneration adequately. Lacks return format details but overall sufficient.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The sole parameter product_id has no description in schema (0% coverage) and the description adds no further semantics beyond the name, failing to compensate for schema detail.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it returns a CycloneDX 1.6 VEX document for a specific product, distinguishing it from siblings like get_product (general info) or get_cve (CVEs).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage for obtaining VEX documents and notes caching behavior but lacks explicit guidance on when to use vs alternatives or conditions like invalid product_id.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description bears full responsibility. It discloses that the tool is read-only (listing) and provides behavior for free users (upgrade message). It also mentions 'denormalized analysis stats' giving insight into the output. This is sufficient transparency.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences long with no unnecessary words. The first sentence states the main action, and the second provides the key condition. It is front-loaded and efficient.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With 0 parameters and an output schema (not shown), the description covers all necessary context: it lists user's products, includes analysis stats, and notes the paid plan restriction. There are no gaps for an agent to make a decision.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has 0 parameters, so the baseline is 4. The description does not need to add parameter semantics and correctly focuses on the tool's behavior.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it lists the calling user's products with denormalized analysis stats. It specifies the verb 'list' and the resource 'products' with additional detail on the content (denormalized analysis stats). This distinguishes it from sibling tools like 'create_product' and 'get_product'.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly states that it is for paid plans only (basic/pro/enterprise) and that free callers receive an upgrade message. This provides clear guidance on when to use the tool, though it does not explicitly mention alternatives for free users.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description discloses key behaviors: records request, emails confirmation, admin review, no account creation, response does not reveal account state. Minor gaps: no details on failure modes or rate limits.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with an opening purpose statement, a paragraph on usage and limitations, and a parameter section. It is moderately sized without unnecessary words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers purpose, usage, and basic behavior but lacks details on what the tool returns (no output schema) and error handling. This is a gap given no output schema.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 0% schema description coverage, the description compensates by explaining that email is required and name/reason are optional context for the reviewer, and that response is identical regardless of email being known. Could add format or constraints.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool requests an invitation to KernelScan, uses a specific verb-resource pair, and is distinct from sibling tools which deal with products, CVEs, and support.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly says when to use it ('keyless caller wants full service') and what it does NOT do (no account creation or API key minting), but does not name alternative tools or explicitly state when not to use it.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description must disclose all behavioral traits. It covers tier differences, query behavior, sorting (newest first), and max limit. However, it does not describe the return fields (no output schema) or error handling, leaving some behavioral gaps.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is relatively concise with clear point-by-point explanations, though the tier information could be briefer. It front-loads the purpose and uses line breaks for readability.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given 0% schema coverage, no annotations, and no output schema, the description covers the main functionality well (parameters, tiers, sorting). However, it lacks details on return fields and error conditions, which would make it more complete for an agent.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must explain all parameters. It thoroughly describes all five parameters (query, severity, cvss_min, published_after, limit) with details on matching, filtering behavior, and default values, adding significant beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description explicitly states 'Search Linux kernel CVEs' with a clear verb and resource. It distinguishes itself from sibling tools like 'get_cve' by focusing on search over multiple CVEs, not a single one.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description details tier-based access restrictions (keyless, free keyed, basic+ keyed) and explains how each filter works (query, severity, cvss_min, published_after, limit). However, it does not explicitly state when to use search_cves versus get_cve (direct lookup), though the context implies it.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries full burden. It discloses that caller API key user (id, email, plan) is attached automatically, and lists categories and optional IDs. No side effects are mentioned, but for a submission tool this is sufficient.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is fairly long but well-structured with bullet points and front-loaded purpose. Every sentence adds value, though slight trimming could improve conciseness.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given 6 parameters, no output schema, and a support tool context, the description covers categories, optional IDs, and user info attachment. It does not specify return value, but for a submission tool this is acceptable.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%, so the description compensates by explaining the category enum values in detail and clarifying that cve_id, product_id, assessment_id are optional but recommended. Subject and message are self-explanatory.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool sends a support/dispute report to KernelScan staff, and distinguishes from sibling tools like product and CVE tools by focusing on human review of automated assessments.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly says to use when an automated assessment looks wrong or when human context is needed. It does not explicitly mention when not to use, but the purpose is clear enough to guide selection.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description fully discloses behavioral traits: it spends one unit of the shared monthly analysis allowance on re-running analysis, can fail with a durable 429 quota error distinct from the transient rate-limit, and explicitly says 'don't retry it'. It also explains the semantics of config_upload_id and factor_ids, covering side effects and edge cases.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is dense but well-structured, with each paragraph addressing a distinct aspect (basic behavior, config upload, cost/error handling). Every sentence adds value, and it is front-loaded with the primary purpose. It is longer than a minimal description but appropriately so given the tool's complexity.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 7-parameter mutation tool with no annotations and no output schema, this description is remarkably complete. It covers authorization ('owned by caller'), quota impact, error differentiation, parameter semantics, and references the API route. No important aspect of tool behavior is left unexplained.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, but the description compensates for the non-obvious parameters: config_upload_id (upload flow, None keeps existing), factor_ids (None vs empty list), and kernel_version/arch (trigger analysis). Name, description, and product_id are left to the schema but are self-evident. Minor gap: no explicit treatment of name/description, but these are trivial.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a clear verb+resource: 'Update a product owned by the caller.' It further clarifies scope by specifying when analysis is re-run (kernel_version, arch, or .config changed), which also distinguishes behavior from the sibling create_product. This makes the tool's purpose unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives explicit guidance on when analysis is re-run versus free edits (rename/description/factor-only), and explains the multi-step process for changing the .config via the upload endpoint. It references the API tier gates and create_product for the curl recipe. However, it does not explicitly state 'use this to update an existing product instead of create_product', though it is implied.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description bears full responsibility. It discloses the keyless usage and payload variation, which is important behavioral context. It could mention that it is a read-only operation, but the description implies safety through its read nature.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, front-loaded with the core purpose, no fluff. Every sentence adds critical information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a zero-parameter, read-only identity tool with no output schema, the description fully covers the return value and the keyless edge case. No gaps identified.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

There are no parameters, so the description does not need to elaborate. It adds value by explaining the different response formats based on authentication state, which is beyond the schema's scope.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a clear verb 'Return' and specifies exact resources: 'identity, plan, and quota state'. It also distinguishes behavior for keyless vs keyed callers, which differentiates it from sibling tools that are CRUD or search operations.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description states it works without an API key and describes the payload difference, providing clear context for when to use. It does not explicitly list when not to use or alternative tools, but the behavior is self-contained.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.